Threat actors are abusing fake OpenAI Codex download pages to trick macOS users into running malware through Terminal.
The campaign uses ClickFix, a social-engineering technique that convinces victims to manually paste and execute a command instead of downloading a clearly malicious file.
The attack begins with sponsored Google search results for queries such as “codex macos download.” These ads appear above legitimate OpenAI links and redirect users to convincing Google Sites pages impersonating a Codex download portal.
The pages display macOS and Linux download options, although researchers observed active malware delivery only for macOS users.
Google Sites provides the initial layer of trust, but it does not host the active malicious content. Instead, the lure embeds an attacker-controlled external page through an iframe.
This setup lets attackers use a reputable Google-hosted domain for credibility while changing their ClickFix content, payload hosts, and infrastructure independently.
Fake Codex Terminal Malware
When a macOS visitor selects the fake download option, the page instructs them to open Terminal and paste a command.
The command resembles a legitimate Codex npm installation process, but it secretly decodes a Base64-encoded URL and retrieves a remote script. That script is then piped into zsh for execution.
The infection chain has three stages. First, the pasted command downloads a shell-script loader. This loader contains an obfuscated embedded payload, which it decodes and runs using eval.
The resulting second-stage script sends execution telemetry to an attacker-controlled endpoint using event=pasted.
The second stage then downloads the final Mach-O payload to /tmp/helper. It removes extended attributes using xattr -c, makes the file executable with chmod +x, and launches it.
Removing extended attributes can strip download-related quarantine metadata, reducing macOS warning context associated with files obtained from the internet.
Researchers observed changes in the loader across infrastructure sets. Earlier versions used compressed Base64 content, while newer variants used an AES-encrypted gzip container and reconstructed decryption keys from multiple variables.
These changes add analysis friction without changing the final delivery flow. The campaign shows strong overlap with Atomic macOS Stealer (AMOS) delivery activity.
Shared traits include Base64-decoded curl loaders, obfuscated zsh scripts, event=pasted telemetry, update-themed payload URLs, universal Mach-O binaries, staging in /tmp/helper, and removal of extended attributes before execution, catonetworks said.
Indicators of Compromise
| Infrastructure Set | Indicator | Type | Role |
|---|---|---|---|
| Set 1 | sites[.]google[.]com/view/codex-desktop-app/ | URL | Fake Codex Google Sites lure |
| Set 1 | bright-links[.]com |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
