I'm having the same issue however I may have fixed it using EtreCheck.
There are two main paths that are being used to produce the safari extension application. This path is: library/ApplicationSupport/Agent/Macsearch
in this folder there is a lot of junk to delete and it seems to be producing the safari extension in a separate folder.
The separate folder is located under users/shared and you will find a folder there with multiple safari extensions individually produced on a timed basis.
I'm not sure if this has fully fixed it but I found malware bytes didn't pick up anything.
To be honest I've never had anything so aggressive on a mac before.