AINEWS
Crooks are buying sponsored Google results for OpenAI's coding assistant to trick Mac users into pasting a malicious install command into Terminal, which then drops Mac malware.
Crooks are buying the top sponsored Google result for "codex macos download" and dropping Mac malware through a fake OpenAI Codex installer. The campaign, documented by Cato Networks' Cato CTRL threat research team on August 24, 2026, treats paid search ads the way phishers used to treat email: a trusted surface for getting the right victim to type the right command. Codex is OpenAI's coding assistant, a developer tool that runs in the terminal and edits code on a user's machine, which is why the lure is aimed at people who would happily paste a one-line install command.
The landing page is a Google Sites page that copies the Codex download portal, with macOS and Linux buttons visible. Only the macOS path delivers an active payload in Cato's observation. The Google Sites page itself carries no malicious code; the active content sits in an attacker-controlled iframe (an embedded page loaded from a separate server), so the operators can rotate the lure without touching the visible Google Sites front.
Cato identified three infrastructure sets. One set hides the live lure under a /codexx/ path while the more intuitive /codex/ path returns a benign product page. Non-macOS visitors are served benign content. The OS- and path-aware gating is what defeats casual scanning by researchers and sandbox services.
The next step is a ClickFix: the victim is walked into opening Terminal and pasting a command that looks like a plausible Codex install string. The command decodes a Base64 URL and pipes a remote shell script into zsh. ClickFix is the name security researchers give to attacks that depend on the user copying and pasting a malicious command into their own terminal. It defeats the assumption that users will not run unfamiliar code by making the paste look like a routine install step.
According to Cato's research, the infection runs in three stages. First, a shell-script loader padded with dead code and unused variables wraps an encoded blob that is decoded with eval. The second stage first emits an event=pasted telemetry beacon to an attacker endpoint, then drops a universal Mach-O (the compiled binary format macOS runs), built to run on both Intel and Apple Silicon Macs. The final binary is staged at /tmp/helper.
The second stage strips the quarantine extended attributes with xattr -c and marks the file executable. Quarantine attributes are the macOS markers that flag a file as downloaded from the internet and trigger the warning prompt before launch. Stripping them lets the malware run without the "are you sure?" dialog.
The delivery framework shows strong overlap with documented AMOS (Atomic macOS Stealer) activity: the loader URL structure, event=pasted telemetry, /tmp/helper staging, xattr -c clearing, and update-themed payload URLs all match. AMOS is a family of macOS information-stealing malware sold to other criminals. Cato describes the match as strong and consistent with AMOS delivery but stops short of calling the final binary itself AMOS.
Cato has blocked the reused iframe host behind the newest Google Sites lure it found, and SiliconANGLE reports that operators are rotating domains and payload locations. The Register flagged the campaign in its own coverage on August 25.
The Codex ads operation is not isolated. Microsoft documented a related macOS ClickFix operation on August 5, 2026, showing the same shift from openly served lures to fingerprinting-gated delivery. The brand on the landing page rotates; the gate logic, the iframe front, and the Terminal-paste ritual travel with it.
After a separate Tanstack npm supply-chain compromise hit two OpenAI employee devices, OpenAI published guidance urging Mac users to update ChatGPT and Codex, and warning explicitly: "Do not install apps from links in emails, messages, ads, or third-party download sites. Be cautious of unexpected 'OpenAI,' 'ChatGPT,' or 'Codex' installers." That warning now covers more ground than the incident that prompted it.
Cato's detection guidance: "No single stage reliably exposes the attack." Defenders have to correlate sponsored-search delivery, embedded content, Terminal execution, and outbound telemetry rather than rely on any single indicator. The next time the top sponsored result for a trending AI tool points somewhere it should not, the gate logic will be familiar even if the brand is not.