Cybercriminals Use Fake OpenAI Codex Ads to Deploy Mac Malware That Steals Passwords

Crooks push Mac malware through fake OpenAI Codex ads

Sponsored search results lead developers straight into a ClickFix malware trap Cybercrims are using fake OpenAI Codex download pages to trick Mac developers into running malware disguised as installation commands. Researchers at Cato Networks uncovered the campaign after spotting sponsored Google search results targeting people looking to download Codex for macOS. The ads direct would-be users to a convincing-looking download page hosted on Google Sites, complete with the familiar OpenAI branding. There is, however, no Codex waiting at the other end. Instead of serving up an installer, the fake site tells Mac users to open Terminal, paste in a supplied command, and run it. The instructions are dressed up as part of the installation process, but the command quietly kicks off a multi-stage malware infection. It's a variation of the increasingly popular "ClickFix" technique, in which attackers convince victims to execute malicious commands themselves rather than relying on a dodgy attachment or executable to do the dirty work. In this case, the command begins with what appears to be a legitimate npm instruction for installing Codex. Tacked onto it, however, is code that decodes a Base64-encoded URL, fetches an attacker-controlled shell script and pipes it into zsh. That script pulls down another stage, which contacts the attacker's server to report that someone has taken the bait before downloading a Mach-O executable to "/tmp/helper." It then removes security information macOS uses to flag suspicious downloads, helping the malware dodge the usual warnings before it launches. Cato said the final binaries are universal Mach-O files, meaning they can run natively on both Intel-powered Macs and newer Apple Silicon machines. The researchers found substantial similarities between the campaign and Atomic macOS Stealer, better known as AMOS, an infostealer previously spread through fake software downloads and malicious advertising campaigns. Cato isn't quite ready to slap an AMOS label on the malware, but says plenty of fingerprints point in that direction, from how the attack is staged to how the final payload is built. The crooks have also taken steps to keep researchers from getting a good look at their handiwork. Although victims initially land on Google Sites, the malicious content itself is pulled into the page from attacker-controlled infrastructure using an iframe. That infrastructure checks details including the visitor's operating system and the path used to reach it, allowing it to show harmless-looking content when a visitor doesn't fit the profile the attackers are after. Cato said the decoy site offered both macOS and Linux download buttons, although it only observed the malware chain being delivered to Mac users. Codex isn't the only AI coding assistant getting this treatment. During its investigation, Cato found a similar ClickFix page masquerading as Anthropic's Claude Code and sharing infrastructure with the Codex campaign. The attackers don't have to work particularly hard to find their victims, either. Developers searching Google for Codex do that work for them, with sponsored ads pushing the fake download page above the legitimate results. ®

Some Mac users think they're installing OpenAI Codex, but it's actually a malware that can steal passwords in seconds

* Crooks used Google Sites and stolen Google Ads accounts to push fake OpenAI Codex pages * macOS users tricked into pasting Terminal commands, leading to AMOS infostealer infection * Campaign abuses Google's trust signals; Windows download button was a decoy, only Mac payload worked Cybercriminals were seen abusing Google Sites, the Google ad network, and OpenAI's good name, in a campaign that targets macOS users with infostealers. According to security researchers CATO CTRL, the crooks used Google Sites to create a fake version of the OpenAI Codex download site. To avoid being flagged by Google's security systems and ultimately removed, the site itself contains no malicious code or download links, whatsoever. Instead, it hosts an iFrame that displays content hosted elsewhere. Then, they advertised that site on the Google Ads network. Google is usually good at spotting and preventing malicious ads from running on its network, but sometimes threat actors steal legitimate accounts with good standing and use them to bypass automated scans and get the ads listed, while also spending other people's money on the ad campaign. Not ClickFix The ads were displayed to users searching for "codex macos download", at the very top of the page. Using both Google Sites and Google Ads is a deliberate attempt to appear legitimate and trustworthy since after all, many people trust whatever Google displays as the top result without double-checking or scrutinizing the result. Those that do click will see a website that, by all accounts, looks like OpenAI's download site for Codex, the company's AI coding agent. The site has download buttons for both Windows and Mac, but only the latter works. The download and installation process was designed to look "advanced" - instead of getting an executable, the victims are told to paste a command in Terminal. Cato's researchers call this a ClickFix attack, but ClickFix usually displays a fake problem, before offering an equally fake solution. This looks more like another way to appear legitimate because after all, several AI agents are specifically designed to be installed and run from the macOS Terminal, including OpenAI's Codex CLI. The end goal of the campaign is to deploy AMOS, a known macOS infostealer capable of grabbing browser data, login credentials, cryptocurrency wallet information, and more. Via SiliconANGLE Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Fake Codex installer tricks Mac users into pasting malware, Cato finds

Fake Codex installer tricks Mac users into pasting malware, Cato finds Cato Networks Ltd.'s Cato CTRL threat research team today detailed a macOS attack campaign built around a fake OpenAI Codex installer. The lure ends with the victim opening Terminal and pasting a command that runs the malware, the social engineering pattern known as ClickFix. It begins with a sponsored Google search result for queries such as "codex macos download." The ad sits above OpenAI Group PBC's own listing. Clicking it leads to a page on Google Sites that copies the Codex download portal, down to the macOS and Linux buttons. Cato observed payload delivery only for macOS. That Google Sites page carries no malicious code of its own. Attacker content loads inside an iframe, probably routed through a Google static-content proxy. The split lets the operators refresh the ClickFix content without touching the Google Sites page victims actually see. Researchers mapped three infrastructure sets. One of them hides its own lure. The live ClickFix page sits at /codexx/, and the more obvious /codex/ path returns a harmless product page. Non-macOS visitors were served benign content too. An analyst or a scanner requesting the intuitive path may never be served the attack at all. The fake installer walks the user through opening Terminal and pasting a command that starts with a plausible npm install string for Codex. Behind that opening, the command decodes a Base64 URL and pipes a remotely retrieved script into zsh. Three stages follow. First comes a shell-script loader padded with dead code and unused variables, wrapped around an encoded blob that it decodes and runs through eval. The second stage comes out of that eval. Telemetry goes out before anything else, a request to an attacker endpoint carrying event=pasted, which records that someone ran the command. The script then pulls the final payload down to /tmp/helper, .clears the file's extended attributes with xattr -c, makes it executable and launches it. Stripping those attributes removes the download quarantine metadata that would normally put a warning in front of the user. The loader itself has been reworked between infrastructure sets. Early samples compressed and Base64-encoded the second stage. Newer ones use an AES-encrypted gzip container and rebuild the decryption key from several variables scattered through the script. Cato ties the delivery framework to Atomic macOS Stealer, the commodity infostealer better known as AMOS. The overlap covers the loader URL structure, the telemetry request, the staging path in /tmp/helper, the removal of extended attributes and update-themed payload URLs. Researchers described the match as strong and consistent with AMOS delivery activity, without naming the final binary outright. That payload is a universal Mach-O, so it runs on Intel and Apple Silicon Macs. Several campaigns tracked this year have dressed malware delivery in artificial intelligence developer tooling. Microsoft Corp. documented a related macOS ClickFix operation on Aug. 5 that had shifted from openly served lures to browser-fingerprinting gates showing malicious content only to likely targets. Cato said it has blocked the reused iframe host behind the newest Google Sites lure it found, and that it's still watching the operators rotate domains and payload locations. "No single stage reliably exposes the attack," the report said. Detection, the researchers wrote, depends on correlating search delivery, embedded content, Terminal execution and outbound activity.