A fake Codex download campaign has used sponsored search results, legitimate Google Sites pages and ClickFix instructions to trick macOS users into executing malware.
In a technical write-up published on August 24, Cato Networks researchers said they found the campaign directing users from sponsored searches for queries such as “codex macos download” to Google Sites pages impersonating an OpenAI Codex download portal.
The fake portal offered both macOS and Linux download options, but the researchers observed active payload delivery only for macOS.
Google Sites Adds Credibility to the Lure
The visible Google Sites pages were only the front end of the campaign. They embedded attacker-controlled content through an iframe, allowing the operators to use a trusted hosting domain for the initial encounter while keeping the active ClickFix content on separate infrastructure. Cato identified three infrastructure sets, the third of which reused an iframe host seen in the first.
A second set added a simple evasion: the active ClickFix page was served from an unexpected path, while the more intuitive one returned a benign fake product page.
Cato Networks also observed benign content when the Google Sites lure was opened from a non-macOS device. This path- and operating-system-aware gating could cause automated analysis or researchers to receive a harmless page instead of the active lure.
The fake installer then instructed victims to open Terminal and paste a command presented as a legitimate-looking Codex installation. Behind the scenes, the command decoded an encoded URL and retrieved a shell script that continued the infection chain.
The chain ran through three stages, ending in the Mach-O payload. The pasted command retrieved a shell-script loader, which decoded and executed a second-stage script, which in turn fetched the Mach-O.
The network security firm said the loader became more heavily encrypted and obfuscated between infrastructure sets, while the second stage recorded that a victim had pasted the command before retrieving the final payload.
Before launching that payload, the second stage staged it in /tmp/helper and stripped the file's extended attributes, removing the download-related quarantine metadata that normally triggers macOS warnings about files retrieved from the internet.
Read more on macOS ClickFix: Atomic Stealer MacOS ClickFix Attack Bypasses Apple Security Warnings
AMOS Delivery Framework Shows Strong Overlap
Cato Networks found substantial similarities between the campaign's delivery framework and a previously documented Atomic macOS Stealer (AMOS) infection chain, including encoded shell loaders, telemetry requests, update-themed payload retrieval and universal Mach-O payloads, built to run on both Intel and Apple Silicon Macs, staged in /tmp/helper.
The researchers said the overlap was strong and consistent with AMOS delivery activity, rather than presenting it as proof that the final payload was AMOS. They cautioned specifically that the delivery telemetry should not on its own be read as evidence of how the Mach-O behaves once it runs.
The findings fit a wider expansion of AI-tool impersonation and ClickFix campaigns targeting users through trusted platforms and familiar developer workflows.
For defenders, Cato Networks said detecting the campaign required correlating sponsored-search delivery, embedded web content, Terminal execution and outbound activity rather than relying on any single indicator.