Crooks Push Mac Malware Through Fake OpenAI Codex Ads

Cybercriminals are actively targeting Mac developers by distributing malware through deceptive advertisements for popular AI coding assistants like OpenAI's Codex and Anthropic's Claude Code. Researchers at Cato Networks identified a campaign that leverages sponsored Google search results, directing users seeking to download these tools to convincing fake websites hosted on Google Sites. These sites, designed with familiar branding, do not offer the legitimate software but instead prompt users to execute a command in their Terminal, masquerading as part of an installation process.

This tactic, a variation of the "ClickFix" technique, tricks victims into running malicious code themselves. The initial command, presented as a legitimate npm instruction for installing Codex, is appended with malicious code. This code decodes a Base64-encoded URL, fetches an attacker-controlled shell script, and pipes it into the zsh interpreter. The downloaded script then proceeds to contact the attacker's server to confirm the infection and downloads a Mach-O executable to the /tmp/helper directory.

Further complicating detection, the malware manipulates macOS security mechanisms. It removes the quarantine attributes that macOS uses to flag downloaded files as potentially unsafe, thereby helping the final payload evade standard security warnings before execution. The final binaries are universal Mach-O files, ensuring compatibility with both Intel-based Macs and newer Apple Silicon machines, broadening the potential victim pool.

Cato Networks noted significant similarities between this campaign and the operations of Atomic macOS Stealer (AMOS), an infostealer previously distributed through similar malicious advertising and fake download schemes. While not definitively attributing the malware to AMOS, the researchers pointed to numerous shared characteristics in the attack staging and payload construction.

The attackers have also implemented measures to obscure their infrastructure and avoid detection by security researchers. While victims land on a Google Sites page, the actual malicious content is loaded via an iframe from attacker-controlled servers. These servers are designed to check visitor details, such as operating system and referral path, to serve harmless content to non-target visitors, making analysis more challenging.

Beyond OpenAI's Codex, the campaign also targets users searching for Anthropic's Claude Code. Cato discovered a similar ClickFix page impersonating Claude Code, which shared infrastructure with the Codex campaign, indicating a broader effort to compromise developers interested in AI coding tools.

The ease with which attackers can find victims is a key aspect of this campaign. By purchasing sponsored search results for terms like "Codex download," the malicious ads appear prominently above legitimate search results, effectively intercepting developers actively seeking these tools and leading them directly into the trap.

This campaign highlights a growing trend of attackers exploiting the popularity of AI tools and employing sophisticated social engineering techniques like "ClickFix" to bypass traditional security measures and deliver malware. The targeting of developers, who often have elevated privileges and access to sensitive code, makes this a particularly concerning development.

This new report details how attackers are leveraging Google Sites to host fake OpenAI Codex download pages, a tactic distinct from the previous report's focus on general fake download sites. The campaign specifically targets macOS users by employing a "ClickFix" technique, where victims are prompted to execute commands in Terminal, thereby bypassing standard security warnings. Researchers also observed significant overlap with Atomic Stealer (AMOS) delivery methods, suggesting a sophisticated and evolving malware distribution chain.