SearchPageInstaller

SearchPageInstaller is an adware program that injects unwanted advertisements into your browser and may replace other content in the process. There are no advantages to using SearchPageInstaller, and macOS users should consider uninstalling it at the first opportunity. Professional anti-malware products can guarantee the removal of SearchPageInstaller safely, as well as detecting any other threats related to it.

When the Difference between 'Unwanted' and 'Actively Threatening' Gets Shaky

Most users think of adware as being a relatively harmless, albeit irritating, category of software. That assumption can be more valid for some examples than others. SearchPageInstaller, one of the rare cases of adware for macOS, also conducts its advertising monetization in one of the riskiest ways possible.

SearchPageInstaller is a 2017-dated program only seen in Apple-brand operating system environments. The threat's circulation in the wild extends to at least 2018 and could be ongoing, in lesser numbers, as of 2020. Its motive is generating advertising traffic revenue for the threat actor by showing advertisements in the user's browser, much like the pop-ups or keyword hyperlinks of other adware.

What makes SearchPageInstaller different from them is its means of advertising display, which abuses mitmproxy – a legitimate proxy application that intercepts HTTP and HTTPS traffic via a man-in-the-middle attack. SearchPageInstaller exploits these features for showing its advertisements and injects them onto the top of HTML pages, even if it has to overwrite preexisting advertisements for doing so. The MITM technique also is notorious, in and of itself, for its data-collecting possibilities (such as in the Retefe banking Trojan attacks, or Comfoo spyware).

Uninstalling a Case of Extra Advertisements

SearchPageInstaller's hijacking mitmproxy for ignoble ends isn't anything unusual for adware, or more intentionally-threatening Trojans. Threat actors turn free hosting sites like GitHub and free software like XMRig into tools for committing crimes and making money through harming PC users and the internet at large regularly. In SearchPageInstaller's case, it also shows the importance of cyber-security companies having accurate and flexible threat detection heuristics, for telling the difference between a consensually-installed program, and one that unwanted software drops by itself.

The advertisements that SearchPageInstaller shows may modify the formatting of Web pages in negative ways, as well as become potential dangers to users. Improperly-vetted advertising networks can display fake software updates and other tactics that will drop other threats onto your PC or harm Web-browsing performance. Since there aren't any advantages to having SearchPageInstaller, most macOS users should default to uninstalling it as a baseline reflex for their safety.

SearchPageInstaller takes advertising too far for tolerating, but it's not by accident. No one who understands what SearchPageInstaller's code can do would willingly use this program as a Web-browsing companion, but one needn't look inside an application to know that it's not worth any trust.