A new campaign is leveraging sponsored search results and legitimate Google Sites pages to distribute macOS malware, tricking users into executing malicious commands under the guise of installing OpenAI's Codex. The campaign was detailed in a technical write-up published on August 24 by researchers at Cato Networks.
The attack begins when users search for terms like "codex macos download" and are directed to sponsored results. These results lead to Google Sites pages that mimic an official OpenAI Codex download portal. While the fake portal offers download options for both macOS and Linux, active payload delivery has only been observed for macOS.
The Google Sites pages serve as a front, embedding attacker-controlled content through an iframe. This allows the attackers to use a trusted domain for the initial interaction while hosting the active malicious content on separate infrastructure. Cato Networks identified three distinct infrastructure sets involved in the campaign, with one iframe host being reused across two of them.
To evade detection, one set of infrastructure served the active malicious page from an unexpected URL path, while the more intuitive path returned a benign, fake product page. Additionally, the Google Sites lure displayed harmless content when accessed from a non-macOS device. This operating-system-aware gating could cause automated analysis tools or researchers to encounter a benign page instead of the active lure.
Victims who proceed are instructed to open Terminal and paste a command, presented as a legitimate Codex installation instruction. This command, however, decodes an encoded URL and retrieves a shell script, initiating a three-stage infection chain. The first stage involves a shell-script loader, which decodes and executes a second-stage script. This second script records that the victim has pasted the command before fetching the final Mach-O payload.
Before launching the final payload, the second stage places it in the `/tmp/helper` directory and strips its extended attributes. This action removes the download-related quarantine metadata that typically triggers macOS warnings for files downloaded from the internet.
Cato Networks researchers noted significant similarities between this campaign's delivery framework and previously documented Atomic macOS Stealer (AMOS) infection chains. These overlaps include the use of encoded shell loaders, telemetry requests, update-themed payload retrieval, and universal Mach-O payloads designed to run on both Intel and Apple Silicon Macs, staged in `/tmp/helper`. While the researchers described the overlap as strong and consistent with AMOS delivery activity, they cautioned that the delivery telemetry alone does not confirm the final payload is AMOS or how it behaves once executed.
The campaign aligns with a broader trend of AI-tool impersonation and "ClickFix" campaigns that exploit trusted platforms and common developer workflows. For effective defense, Cato Networks advises correlating indicators such as sponsored-search delivery, embedded web content, Terminal execution, and outbound network activity, rather than relying on any single indicator.
