virus 'application.work' installs as a safari extension but is trying to mine banking data
I have been using safari in the last week (20th March today) when something automatically begins to download. It shows as a green magnifier in the dock and tries to instal a safari extension - the extension manager advises me that the extension will allow all banking transactions and passwords to be logged.
Obviously concerned I deleted the extension file immediately, and the application from the program folder.
A couple of days later it happened again.
This time I looked not just at the two locations but I tracked a file in among the apple.work section. it looked identical to all the others but did not have the 'apple' section in the file name.
I deleted the files too.
I have searched - but the name they are using 'application.work' brings up thousands of results none of which appear to relate to this 'virus'
I even searched here to see if anyone else is having the same issue, but there is nothing listed.
Can anyone tell me if this is safely removed? I am nervous about using any banking sites after this.
Thank you.
MacBook Pro 13", macOS 10.14