How to resolve persistent SafariSearchUploadWorker password popup on Mac?

The reply should distinguish between what is known, what is suspected, and what can actually be established.

The fact that another post labels SafariSearchUploadWorker as malware does not, by itself, prove that the process is malicious.

Equally, the fact that a process name resembles a macOS component does not establish that it is legitimate.

A persistent keychain password prompt deserves investigation, particularly when previous troubleshooting has failed. The response should address the malware allegation directly without presenting an unverified diagnosis as fact.

The persistent SafariSearchUploadWorker keychain popup is concerning, but I would be cautious about concluding that it is definitely malware without verifying the process.

The other post identifies it as an adware or browser-hijacker variant that impersonates legitimate macOS processes.

That is a possibility worth investigating, but the post alone does not establish that diagnosis.

Apple documents that legitimate applications can request access to passwords stored in the macOS keychain. Apple also warns that a previously trusted application requesting access again, particularly when it has not recently been updated, may have been modified or infected. See Apple’s guidance on unexpected keychain access requests.

In this case, the recurring popup, the unsuccessful troubleshooting, and the absence of obvious login items, configuration profiles, or Safari extensions justify further investigation. 

However, a clean Malwarebytes scan does not conclusively rule out malware, and using DuckDuckGo as the default browser does not establish whether a background process is legitimate.

Before erasing the Mac and reinstalling macOS, I would ask Apple Support to identify the exact executable responsible for the popup, including its full file path, digital signature, and developer identity. 

The process name alone is insufficient to establish whether it belongs to Apple or a third party. I would also ask them to investigate background services and launch agents, which can operate independently of the visible login items.

Until the process has been verified, I would not enter my password or select “Always Allow” for this request. If the prompt is unexpected, deny it.

Given that several support sessions have not resolved the issue, I would want a specific technical explanation of the process and its origin before agreeing to erase the Mac. 

A clean operating-system installation may be appropriate if an infection is confirmed or cannot otherwise be removed, but it should not substitute for identifying the cause.

The key question is whether SafariSearchUploadWorker is an authentic, appropriately signed component on this particular Mac or an executable impersonating one. 

Establishing its origin is the most useful next step toward resolving the popup and determining whether this is malware or a legitimate process experiencing a problem.

The relevant Apple references are keychain access requests and inspecting keychain items.

The SafariSearchUploadWorker popup is malware. Specifically, it is a variant of an adware/browser hijacker bundle designed to mimic legitimate macOS core processes (like accountsd or SafariLaunchAgent) to trick you into granting it access to your passwords and sensitive information.

Because it roots itself into your user profile settings, a simple macOS reinstall often fails to fix it if your user data and profiles are preserved during the reinstall process.

Follow these targeted steps to remove it completely without wiping your computer.

Step 1: Check for Malicious Profiles

Adware often installs a hidden "Configuration Profile" to force your Mac to run these processes and prevent you from changing browser settings.

• Open System Settings (or System Preferences).
• Look for an icon called Profiles near the bottom of the sidebar. (Note: If you don't see a Profiles icon, skip to Step 2).
• Click Profiles, select any suspicious profile you do not recognize (often named something like TechSignalSearch, MainSearchPlatform, or Safari Preferences), and click the minus (-) sign to delete it.

Step 2: Remove Suspicious Login Items & Background Tasks

• Go to System Settings > General > Login Items.
• Look at the list under Open at Login and Allow in the Background.
• Look for anything containing "Search", "Upload", "Worker", or any unfamiliar names. Select them and toggle them off or remove them by clicking the minus sign.

Step 3: Run an Adware Scanner (offered based on the recommendations of others*)

Because this specific malware hides deep in the user ~/Library folders, standard tools miss it.

• Download the free version of Malwarebytes for Mac, which is widely recognized by the Mac community for handling browser hijackers.
• Run a full scan. It should flag the SafariSearchUploadWorker files immediately and move them to quarantine.
• Delete the items from quarantine and restart your Mac. 

* Note: I have no experience with Malwarebytes and cannot personally recommend it (I have never been duped into installing malware), but many long-time members here are comfortable recommending it as pretty much the only useful anti-malware tool.

Step 4: Clean Safari Extensions and Search Settings

If the process is gone but the popup has left remnants in Safari:

• Open Safari and go to Settings (or Preferences) > Extensions.
• Look for any extensions you don’t remember installing. Select them and click Uninstall.
• Go to the Search tab in Safari settings and ensure your default search engine is set back to Google, DuckDuckGo, or your preferred trusted engine

Malware running on a Mac happens only because the user permits it. To prevent this from happening in the future, read and follow the advice from Apple:

Protecting against malware in macOS – Apple Support

I went in to the Keychain Access app via Spotlight and deleted several stored passwords for devices no longer used. I also deleted all of the expired certificates and select certificates for apps I no longer use.

So far the SafariSearchUploadWorker popup window has not re-appeared. I am cautiously optimistic that the actions I have taken have resolved the issue.

Thank you to all who contributed to this thread.

Thank you for your detailed reply. I have followed all of the steps you outlined. There were no other profiles created. There are no apps set to launch at start up and I have deleted or turned off all of the apps that might have been running in the background with the exception of Microsoft Office Auto Update.

I downloaded MalwareBytes and gave it full disk access. A scan showed my system is clean. Lastly, there are no Safari extensions and my default browser is set to Duck Duck Go.

I am hopeful that the steps you outlined will have solved my issue and will have to wait and see if the popup re-appears.

Thanks again.