Cato Networks uncovered a campaign in which sponsored Google search results steer Mac users toward convincing fake OpenAI Codex download pages that instruct victims to paste a Terminal command — a step that unleashes a multi-stage malware infection.
Fake OpenAI Codex pages, Google ads, and Google Sites hosting
Researchers at Cato Networks found attackers buying sponsored search results to push a counterfeit Codex download page above legitimate links. The landing page is hosted on Google Sites and uses familiar OpenAI branding to appear authentic. Rather than delivering an installer, the site tells macOS users to open Terminal, paste a provided command, and run it as though it were an installation step.
ClickFix technique: a malicious command that self-executes
The campaign uses a variation of the "ClickFix" technique, where victims are persuaded to execute malicious commands themselves instead of running an attached executable. The supplied command begins with what appears to be a legitimate npm instruction for installing Codex but has additional code appended. That appended segment decodes a Base64-encoded URL, fetches an attacker-controlled shell script and pipes it into zsh. The first-stage script then pulls down a second-stage component, which contacts the attacker's server to report that a victim has taken the bait before downloading a Mach-O executable to “/tmp/helper.”
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildMac-specific evasions: removing macOS security info and universal binaries
Once the Mach-O helper arrives, the chain removes security information macOS uses to flag suspicious downloads, helping the malware dodge the operating system's usual warnings before it launches. Cato reported the final binaries are universal Mach-O files, which can run natively on both Intel-powered Macs and newer Apple Silicon machines — widening the range of vulnerable hosts the payload can run on.
Shared infrastructure and links to AMOS (Atomic macOS Stealer)
Cato said it found substantial similarities between the campaign and Atomic macOS Stealer, better known as AMOS, an infostealer previously spread through fake software downloads and malicious ad campaigns. Cato stopped short of definitively calling the payload AMOS, saying "plenty of fingerprints point in that direction" — from staging patterns to how the final payload is built. During the investigation Cato also found a similar ClickFix page masquerading as Anthropic's Claude Code that shared infrastructure with the Codex campaign.
How the attacker-controlled infrastructure shields the campaign
Although the initial decoy pages are served from Google Sites, the malicious content itself is injected into the page via an iframe that pulls from attacker-controlled infrastructure. That infrastructure checks details including the visitor's operating system and the path used to reach the page, allowing it to serve harmless-looking content when the visitor does not fit the attackers' target profile. Cato observed the decoy offering both macOS and Linux download buttons, but the researchers only observed the malware delivery chain being executed for Mac users.
What this means for Mac developers, security teams, and researchers
- Mac developers: the campaign targets developers searching for AI coding tools; developers who paste installation commands from web pages into Terminal can be directly tricked into executing a multi-stage infection chain rather than receiving legitimate software.
- Security teams and incident responders: the attack chain writes a Mach-O executable to /tmp/helper, removes macOS download flags, and calls back to attacker servers — observable artifacts defenders can hunt for when investigating suspicious Google-driven installs or odd Terminal-executed commands.
- Security researchers: attackers used an iframe and server-side checks (OS and path) to show benign content to non-targets, complicating static discovery and analysis of the malicious content hosted behind the Google Sites landing page.
The campaign underlines a simple but effective tactic: use search advertising to place a fraudulent installer page in front of people actively looking for AI coding assistants, then rely on social engineering to convert a single paste-and-run command into a stealthy, multi-stage compromise. Cato's analysis raises a pointed question for ad platforms and anyone who searches for developer tools — when paid listings and convincing branding can be combined with a simple Terminal command, how should trust and verification be asserted at the moment a user is asked to run code?
