How Fake Codex Download Ads Tricked Mac Developers Into Running Malware

A fake OpenAI Codex download campaign turned a routine developer search into a malware delivery chain. According to Cato Networks’ Cato CTRL researchers, sponsored Google results for queries such as “codex macos download” led users to a convincing Codex imitation hosted through Google Sites. The page did not provide a normal application installer; it persuaded the visitor to run the infection step manually in Terminal. 2910

The attack began with a sponsored search result

The campaign targeted users already looking for a way to install Codex on macOS. The malicious advertisement appeared alongside—or potentially above—legitimate search results and directed visitors to a Google Sites page styled as an official OpenAI Codex download portal. The fraudulent page presented options for macOS and Linux, but researchers observed active payload delivery only for macOS. 510

Using a legitimate Google-hosted domain helped the lure look less suspicious than a newly registered malware domain. Reporting also says the operators used stolen Google Ads accounts, potentially giving the advertisements the appearance of established advertiser identities. 12

ClickFix moved execution from the installer to the victim

Rather than asking the user to download and open a suspicious DMG file, the fake portal instructed them to open Terminal and paste a command. This is the social-engineering technique known as ClickFix: the attacker presents a supposed installation or troubleshooting step, while the victim performs the critical execution action themselves. 21213

The command began with a plausible-looking npm installation string associated with Codex. Behind that appearance, however, it decoded a Base64-encoded URL, retrieved a remote script and passed the result to the macOS zsh shell. 3413

That design exploits developer familiarity with command-line installation. It also removes an obvious warning sign: there is no unexpected application file for the victim to inspect before choosing to open it. The trust decision is instead framed as copying a setup command from an apparently official product page. 212

The delivery chain ended in a suspected AMOS infection

The available reporting describes a multi-stage chain. After the pasted command ran, later scripts fetched a final Mach-O executable, stored it as /tmp/helper, removed its extended attributes with xattr -c, made it executable and launched it. 3411

Removing extended attributes can eliminate macOS quarantine-related metadata and may reduce the number of security warnings shown when a downloaded file is opened. 411 The final binary was reported as supporting both Intel and Apple Silicon architectures, according to technical reporting on the campaign. 1521

Cato described strong overlap with publicly documented Atomic macOS Stealer, commonly known as AMOS, and other reporting identified the payload as a suspected AMOS infostealer rather than a legitimate Codex component. 29 AMOS is associated with the theft of browser data, login credentials and cryptocurrency-wallet information. 1

Trusted infrastructure helped conceal the fraud

The campaign’s effectiveness came from combining several familiar signals rather than relying on one sophisticated exploit:

• Search intent: the ad reached people actively seeking a Codex installation.
• Paid placement: a sponsored result appeared in a high-attention position on Google Search. 912
• Google hosting: the destination used a legitimate sites.google.com domain. 29
• Brand imitation: the page reproduced familiar OpenAI Codex branding. 1012
• Developer language: the command resembled a normal npm setup task. 35
• User-driven execution: ClickFix made the victim run the command instead of opening an unsolicited installer. 213

The fake portal also used an iframe to display attacker-controlled content from a separate malicious domain. That arrangement allowed the visible page to retain the credibility of Google Sites while giving the operators more control over the embedded installation experience. 9

Some additional evasion claims—including exact device- and URL-based benign responses or payload swapping—are described in secondary reporting, but the supplied evidence does not establish every implementation detail independently. They should therefore be treated cautiously rather than as confirmed characteristics of the entire campaign.

What Mac developers should take from the campaign

The most important warning is simple: a command copied from a download page is still code execution. A trusted-looking search result, familiar branding or a Google-hosted URL does not prove that the instructions are legitimate.

For developer tools, installation commands deserve the same scrutiny as downloaded binaries. Verify the publisher and installation method through the product’s known official channels, avoid pasting opaque commands into Terminal, and treat commands containing encoded URLs or remote scripts as a serious warning sign.

The campaign shows why modern malware delivery increasingly targets the path to a product rather than the product itself. Search advertising created the initial trust, Google hosting reinforced it, OpenAI branding made the page familiar and ClickFix converted that trust into a user-authorized malware launch. 234