Sponsored search ads are pushing Mac developers toward fake OpenAI Codex download pages that end with a malicious command pasted into Terminal.
Cato Networks traced the campaign, a ClickFix variant that outsources the infection step to the victim. Ads for queries like “codex macos download” sit above the genuine OpenAI listing and lead to pages hosted on Google Sites that mimic the Codex portal, complete with macOS and Linux options. The visible page is only a front end, embedding attacker-controlled content through an iframe, with three separate infrastructure sets so operators can swap payloads without changing the lure.
The lure is selective about who sees what. Requests hitting the /codexx/ path get the real attack page, while the /codex/ route displays an inert product mockup, and visitors not on Macs are served the harmless variant. Researchers say the gating misleads automated scanners.
Victims are told to paste a command resembling a routine Codex install line. The command hides a Base64-encoded URL; the decoded script gets piped straight into zsh, kicking off a multi-stage infection. A loader runs an embedded script, phones home to log the infection, drops a file to /tmp/helper, strips extended attributes with xattr -c, and launches a universal Mach-O payload built for both Intel and Apple Silicon Macs.
Cato says the delivery chain closely mirrors Atomic Stealer (AMOS) infrastructure, and found related pages impersonating Claude Code. Cato sees the campaign as proof that attackers no longer need shady domains: a top-ranked ad, a trusted host, and a familiar brand were enough to make the trap convincing.
