Cybercriminals are leveraging sponsored search results to distribute macOS malware, impersonating legitimate AI coding assistants like OpenAI's Codex. The campaign, identified by researchers at Cato Networks, targets developers searching for these tools, directing them to deceptive download pages that prompt the execution of malicious commands.
The attack begins with sponsored Google search advertisements for "Codex for macOS." These ads lead users to a convincing-looking download page hosted on Google Sites, which features authentic OpenAI branding. However, instead of providing an installer, the site instructs users to open their Terminal application and paste a provided command, presenting it as part of the installation process.
This command initiates a multi-stage malware infection. It appears to start with a legitimate npm instruction for installing Codex, but it also includes code that decodes a Base64-encoded URL. This URL fetches an attacker-controlled shell script, which is then piped into zsh. The script proceeds to download a subsequent stage, contacting the attacker's server to register the infection. Finally, it downloads a Mach-O executable to the `/tmp/helper` directory. Before launching the executable, the malware removes macOS security attributes that flag suspicious downloads, aiming to bypass system warnings.
Cato Networks confirmed that the final binaries are universal Mach-O files, compatible with both Intel-based and Apple Silicon Macs. The researchers noted significant similarities between this campaign and the Atomic macOS Stealer (AMOS), an infostealer previously disseminated through fake software downloads and malicious advertising. While Cato Networks has not definitively labeled the malware as AMOS, they highlighted numerous commonalities in the attack staging and payload construction.
The attackers have implemented measures to hinder analysis. Although victims initially land on Google Sites, the malicious content itself is loaded via an iframe from attacker-controlled infrastructure. This infrastructure performs checks, including the visitor's operating system and the referral path, to ensure that only targeted profiles receive the malicious payload. Decoy content is displayed to visitors who do not meet the attacker's criteria. While the fake site offered download buttons for both macOS and Linux, the malware chain was only observed being delivered to Mac users.
Cato Networks also discovered a similar "ClickFix" page masquerading as Anthropic's Claude Code, sharing infrastructure with the OpenAI Codex campaign. The use of sponsored search results ensures that the malicious download pages appear prominently, often above legitimate results, increasing the likelihood of developers encountering them.
