A malware campaign using a sponsored search ad and a fake OpenAI Codex download page to trick macOS users into pasting a malicious command into Terminal has been uncovered by Cato Networks.
It’s a variation of ClickFix, a popular social engineering technique that persuades victims to execute the infection step themselves rather than opening a malicious file.
The attack starts with a sponsored search result for queries such as “codex macos download.” The ad appears above the genuine OpenAI listing and sends visitors to a page hosted on Google Sites that mimics an OpenAI Codex download portal, complete with options for macOS and Linux.
Fake Codex download page hosted on Google Sites (Source: Cato Networks)
“We observed active payload delivery for macOS, but not Linux,” researchers said.
“The visible Google Sites page is only the front end. It embeds attacker-controlled content through an iframe, likely loaded through a Google static-content proxy,” they explained.
Cato mapped three infrastructure sets, each pointing to a separate iframe host, allowing the operators to swap the malicious content without changing the initial Google Sites lure.
Pasted terminal command launches multi-stage attack
One of those sets uses an evasion trick. The malicious page loads from /codexx/, while the more obvious /codex/ path displays a harmless fake product page. Visitors using non-Mac devices are also served the benign version.
Cato said this type of gating “can mislead analysts and automated scanners,” since requests that don’t match the attackers’ target profile may never encounter the malicious content.
Victims who reach the malicious page are instructed to open Terminal and paste a command that initially resembles a normal Codex installation line. Instead, it decodes a Base64-encoded URL and downloads a script that is piped into zsh, kicking off a multi-stage infection chain.
Fake installer prompts a Terminal command (Source: Cato Networks)
The first stage acts as a loader that decodes and executes an embedded script. The next stage sends a request to the attackers’ server to record that the command was pasted, then downloads another file to /tmp/helper.
It also uses xattr -c to strip the file’s extended attributes before making it executable and launching it.
The final payload is a universal Mach-O binary capable of running on both Intel-based Macs and Apple Silicon systems.
Fake Codex malware delivery mirrors Atomic Stealer
Cato found strong similarities between the delivery chain and Atomic macOS Stealer (AMOS), an information-stealing malware family previously documented in public security research.
“The overlap includes Base64-decoded /curl/ loaders, compressed and obfuscated zsh stages, telemetry requests to /api/metrics/run?event=pasted, uniquely structured update URLs, universal Mach-O payloads staged in /tmp/helper, removal of extended attributes, and execution of the payload,” researchers wrote.
The campaign isn’t limited to impersonating OpenAI’s Codex. Cato also discovered related infrastructure behind a similar landing page impersonating Claude Code, although that page was hosted outside Google Sites.
“For organizations, the key lesson is that a trusted search result, a legitimate hosting service, and a familiar developer-tool brand can be combined into a credible path to malware execution,” researchers concluded.
