Fake OpenAI Codex Ads Are Serving Mac Malware Via Terminal Commands
Criminals are running sponsored Google ads pointing to fake OpenAI Codex download pages, targeting Mac developers and tricking them into infecting their own machines.
Researchers at Cato Networks caught the campaign after spotting the dodgy sponsored results appearing when people searched for Codex on macOS. The ads lead to a convincing spoof page hosted on Google Sites, dressed up with OpenAI branding. No actual software is waiting there.
Rather than offering a download, the fake page tells users to open Terminal, paste in a command, and run it. This is framed as a normal installation step. It isn't.
This is a ClickFix attack. The technique has been gaining traction because it sidesteps the usual need for a malicious attachment or executable. The victim does the work themselves, copy-pasting a command that quietly starts a multi-stage infection.
The command begins plausibly enough, resembling a legitimate npm install instruction for Codex. Hidden within it is code that decodes a Base64 URL, fetches a shell script from an attacker-controlled server, and pipes it straight into zsh. That script pulls down another stage, phones home to confirm a successful hit, downloads a Mach-O binary to /tmp/helper, and strips out the macOS security metadata that would normally trigger a warning before launching the payload.
The final binaries are universal Mach-O files, so they run natively on both Intel Macs and Apple Silicon. The attackers aren't leaving hardware compatibility to chance.
Cato noted strong similarities between this campaign and Atomic macOS Stealer, also known as AMOS, an infostealer with a history of spreading through fake downloads and malvertising. They're not formally attributing the malware to AMOS yet, but the staging method and payload construction apparently look very familiar.
The infrastructure also has some anti-analysis measures baked in. The fake page itself is hosted on Google Sites, but the actual malicious content is loaded in via an iframe from attacker-owned servers. Those servers check the visitor's operating system and referral path, serving harmless content to anyone who doesn't match the target profile. Researchers poking around get a blank wall.
The decoy page offered both macOS and Linux download buttons, though Cato only observed the malware chain being triggered for Mac visitors.
Codex isn't the only tool being spoofed. Cato found a separate ClickFix page impersonating Anthropic's Claude Code, sharing infrastructure with the Codex operation. Whoever is running this campaign appears to be broadening their net across the AI coding assistant market.
The targeting mechanism is almost embarrassingly simple. Developers search Google for a tool they want to use, a paid ad puts the fake page above legitimate results, and curiosity does the rest.