PanicStation.org
UK USA
us Technology & digital loss browser homepage changed overnight • default search engine changed • browser hijacker • unwanted search engine • suspicious browser extension • homepage keeps changing back • search redirect • new tab page changed • chrome settings changed overnight • edge search engine changed • firefox homepage changed • safari homepage changed • adware suspected • potentially unwanted program • malware scan now • account sync changed settings • managed by your organization message • report online fraud • protect passwords now

What to do if…
your browser homepage and default search engine change overnight

Short answer

Assume something is controlling your browser: stop using it for sensitive logins, remove unknown extensions/apps, reset the browser, run anti-malware, then secure your key accounts.

Do not do these things

  • Don’t sign into banking, email, or your password manager in the affected browser until you’ve cleaned it.
  • Don’t install “browser cleaner” tools suggested by pop-ups or unfamiliar download sites.
  • Don’t click “Allow” on notification prompts from unfamiliar sites (it can flood you with scam alerts).
  • Don’t keep toggling the homepage/search engine over and over if it keeps reverting — fix what’s enforcing it.
  • Don’t bypass workplace IT rules if this is a work/school device — policy-controlled settings may require admin help.

What to do now

  1. Stop sensitive use immediately. Close the browser. If you must do something urgent, use another device (or your phone) first.
  2. Check whether settings are being enforced.
    • If the browser shows “Managed by your organization” and this is a work/school device, contact your IT/admin.
    • If it’s a personal device and this appears unexpectedly, pause before removing anything you don’t understand (it could be from security software or past device management). If you’re unsure, get trusted tech help after you complete steps 3–6.
  3. Remove suspicious extensions/add-ons (most common cause).
    • Open the extensions/add-ons page and disable anything you don’t recognize (especially “search”, “new tab”, “coupon”, “PDF”, “security”, “assistant” tools you didn’t choose).
    • Then remove them.
  4. Use the browser’s built-in reset/refresh to undo changes.
    • Chrome: use Reset settings to restore defaults.
    • Firefox: use Refresh Firefox.
    • Safari (Mac): open Safari Settings and check Extensions (remove unknown), Search (set default search engine), and General (set Homepage).
  5. Remove the installer (often a bundled program).
    • Windows: check installed apps/programs and uninstall anything unfamiliar that appeared around the time the change started.
    • Mac: check Applications for unknown items; removing the app can remove the extension it installed.
  6. Run anti-malware and update.
    • Run your device’s built-in protections (for example Windows Security) and any reputable anti-malware you already have.
    • Update your OS and browsers.
  7. Secure accounts if there’s any chance credentials were exposed.
    • Change passwords for email first, then financial accounts, then any accounts that reuse the same password.
    • Turn on multi-factor authentication where available.
    • If you can, do password changes from a different device or after cleaning.
  8. Report if it involved fraud, money loss, or an obvious scam path.
    • Report scams/fraud to the Federal Trade Commission using ReportFraud.
    • If you were the victim of a cyber-enabled crime (account takeover, theft, fraud), you can file a complaint with the FBI Internet Crime Complaint Center (IC3).

What can wait

  • You don’t need to prove exactly what caused it before taking action — prioritize removing control (extensions/apps), scanning, and account security.
  • You don’t need to wipe your computer right away if the steps above resolve it and the change doesn’t return.
  • You don’t need to respond to pop-ups or “support” phone numbers connected to the hijack — ignore and close them.

Important reassurance

A sudden homepage/search change is often caused by a single extension or bundled app, not a sophisticated attacker. The steps above are designed to quickly regain control and reduce the chance of further harm.

Scope note

These are first steps only. If the problem returns after removal, reset, scanning, and updates, you may need deeper device cleanup (professional support) and closer account monitoring.

Important note

This is general information, not professional security advice. If you suspect ongoing compromise, identity theft, or financial fraud, prioritize securing accounts and using official reporting channels.

Additional Resources
Support us