Hello,
It is probably malware. I've seen a lot of similar posts recently. One person actually sent me an EtreCheck report. I'll go ahead and post my EtreCheck blurb in case you want to post your report.
I wrote a little diagnostic program to help show what adware is installed. Download EtreCheck from https://www.etrecheck.com, run it, and paste the results here. EtreCheck is perfectly safe to run, does not ask for your password to install, and is signed with my Apple Developer ID. When you are done, EtreCheck can be thrown in the trash.
If adware is installed, EtreCheck will help you remove it, although you may have to supply a password. If you aren’t comfortable with that, just post the EtreCheck report here and other helpers can tell you exactly what files need to be deleted and how to do so.
EtreCheck normally targets adware only. It will detect malware too, but I'm too busy to deal with that. However, in this case, the behaviour that I've seen definitely sounds more like malware than adware.
Disclaimer: Although EtreCheck is free to download and use at first, it will eventually ask you to buy a license. There are also other links on my site that could give me some form of compensation, financial or otherwise.