What is Cloudfront.net adware and how can I get rid of it?

If you’ve noticed that your web browser is persistently redirecting site requests to Cloudfront.net, you may have installed adware. In this article, we’ll explain what Cloudfront.net is and how to get rid of the adware. 

What is Cloudfront.net?

Cloudfront.net is not a virus; it is a content delivery network owned by Amazon. Whenever you download anything from Amazon — like music or an eBook — it likely comes via Cloudfront.net. However, Amazon also rents out Cloudfront.net to third parties via Amazon Web Services (AWS). Anyone with a credit card can sign up to AWS and use it to store files and deliver them via download. 

The vast majority of people and businesses who do that do it for legitimate purposes. However, as with everything, there are a few who use it for malicious reasons — in this case, hosting adware. So, when you notice your web browser redirecting you to Cloudfront.net, it has nothing to do with Amazon; it’s a third party using its services.

How did the adware get on my Mac?

Like most adware, it probably came bundled when you downloaded what seemed to be legitimate software, possibly from a free download site that uses its own proprietary download manager. These download managers bundle other software with the app you chose to download. If you must use them — and it’s better if you don’t — make sure to choose the custom install option and untick all the boxes except the one for the app you want to download.

Bundled software can also come with Mac apps like media players that are no longer updated by their developer and have been ‘hijacked’ by hackers to deliver malware. 

How can I avoid downloading adware?

The simplest way to avoid downloading any malware is to use an anti-malware tool and have it set to automatically scan your Mac and alert you if you download anything malicious. I recommend CleanMyMac X, which has real-time malware monitor and background protection tools that scan your Mac and warn you if it finds anything. Unlike those horrible ‘your Mac is infected’ pop-up scams you sometimes see, CleanMyMac X is a legitimate anti-malware and clean-up tool that has been notarized by Apple.

I also recommend scanning your Mac regularly with its Malware Removal tool, just in case anything gets through the net.

Here’s how to scan for malware:

1. Download CleanMyMac X. Install the app and then launch it from Applications
2. Click on Malware Removal and press Scan.
3. If CleanMyMac X finds malware, press Remove to get rid of it.

In addition, there are several steps you can take to ensure you don’t inadvertently download anything nasty:

1. Don’t use proprietary download managers (or, if you must, use the custom option as described above).
2. Don’t ignore warnings from your web browser that a site you are about to visit is malicious.
3. If you see a message from macOS’ Gatekeeper telling you that you are about to install a file downloaded from the internet, think carefully before giving it permission.
4. Be vigilant when it comes to clicking links and installing browser extensions. Make sure that they are safe first. 

How to remove Cloudfront.net adware

The steps for removing this adware from your Mac are the same as those for removing other types of adware:

• Get rid of the application it was bundled with.
• Remove associated files.
• Uninstall malicious browser extensions.
• Remove website data like cache files.

Remove the application

Go to your Applications folder and remove the app you downloaded just before you noticed the adware. Drag it to the Trash and empty it.

Get rid of associated files

These files live in different folders within your main Library and user Library folders. To get rid of them, use the Finder’s Go menu and the Go to Folder tool to navigate to the following locations and remove anything that seems suspicious

/Library/LaunchDaemons

/Library/Application Support

~/Library/Application Support

Also, launch System Preferences, then choose Users & Groups and click on your user name and Login Items. Use the ‘-’ button to disable any login items that look like malware.

Uninstall browser extensions

The process depends on which browser you use, but in each case, you locate the list of installed extensions and use the ‘Uninstall’ or ‘Remove’ button to get rid of any that seem suspicious. Here’s where to find them:

• Safari

Go to Preferences > Extensions.

• Chrome

Type chrome://extensions into the address bar.

• Firefox

Click on the three horizontal lines on the right of the address bar, then choose Add-ons and Extensions.

Once you’ve removed suspicious extensions, you should also clear out website data like cookies and history files.

• Safari

Go to Preferences > Privacy > Manage website data.

• Chrome

Type this chrome://settings into the address bar and press Enter.

• Firefox

Click on the three horizontal lines, then go to Preferences > Privacy & Security > Clear data.

Once you’ve done all that, you should have removed every trace of adware from your Mac. 

Cloudfront.net is not adware itself. It is a content delivery network owned and run by Amazon. However, it is available for third parties to use for a fee for cloud storage and content delivery. Some malicious actors use it to host and deliver adware, which is why you might notice adware redirecting your browser to Cloudfront.net. Fortunately, the adware isn’t difficult to get rid of, although there are several steps involved. If you want to make it easier and prevent adware from getting onto your Mac in the future, we think the best solution is CleanMyMac X. As well as protecting your Mac from malware, it can clean out website data, remove extensions, and get rid of other junk files, helping your Mac run more smoothly and more quickly.