A campaign impersonating the OpenAI Codex tool has exploited sponsored search results and legitimate Google Sites pages to distribute malware to macOS users, according to a technical analysis published August 24 by Cato Networks. The attack combined paid advertising, trusted hosting infrastructure, and ClickFix social engineering techniques to trick victims into running malicious commands through Terminal. The campaign directed users searching for terms like "codex macos download" to fake download portals that appeared credible because they were hosted on Google's own platform.
The phony portals displayed both macOS and Linux download options, but Cato Networks observed active malware delivery only for macOS devices. The visible Google Sites pages embedded attacker-controlled content through iframes, allowing operators to use a trusted domain for the initial encounter while hosting the active ClickFix instructions on separate infrastructure. Researchers identified three distinct infrastructure sets, with the third reusing an iframe host from the first. The second set added evasion tactics: the active ClickFix page was served from an unexpected URL path, while the more obvious path returned a harmless fake product page. The campaign also delivered benign content when the Google Sites lure was opened from non-macOS devices, creating path- and operating-system-aware filtering that could cause automated analysis tools or researchers to receive a harmless page instead of the actual threat.
The fake installer prompted victims to launch Terminal and paste a command disguised as a legitimate Codex installation script. Behind the scenes, the command decoded an encoded URL and retrieved a shell script that continued the infection sequence. The infection chain ran through three stages before delivering the final Mach-O payload. The pasted command retrieved a shell-script loader, which decoded and executed a second-stage script, which in turn fetched the Mach-O executable. Cato Networks said the loader became more heavily encrypted and obfuscated between infrastructure sets, while the second stage recorded that a victim had pasted the command before retrieving the final payload. Before launching the payload, the second stage placed it in /tmp/helper and stripped the file's extended attributes, removing the download-related quarantine metadata that normally triggers macOS warnings about files retrieved from the internet.
Cato Networks found substantial similarities between this campaign's delivery framework and a previously documented Atomic macOS Stealer infection chain, including encoded shell loaders, telemetry requests, update-themed payload retrieval, and universal Mach-O payloads built to run on both Intel and Apple Silicon Macs staged in /tmp/helper. The researchers explained that the overlap was strong and consistent with AMOS delivery activity, but cautioned specifically that the delivery telemetry should not on its own be read as evidence of how the Mach-O behaves once it runs. The attack fits a wider expansion of AI-tool impersonation and ClickFix campaigns targeting users through trusted platforms and familiar developer workflows.
For defenders, Cato Networks said detecting the campaign required correlating sponsored-search delivery, embedded web content, Terminal execution, and outbound activity rather than relying on any single indicator. The findings highlight how attackers are layering multiple legitimate services—paid search advertising, trusted hosting platforms, and developer-friendly installation patterns—to bypass security controls that focus on individual threat signals. The report underscores that modern social engineering threats are increasingly difficult to detect through traditional endpoint or network monitoring alone. Organizations relying on developer tools and open-source software face a growing challenge as attackers refine techniques that exploit the trust placed in both branded platforms and routine technical workflows. The security industry will need to rethink detection strategies that assume threats arrive through obviously malicious channels rather than through the same trusted paths users rely on daily.