Fake Codex Site Lures macOS Users via Google Ads

Security researchers have uncovered a campaign that abuses Google Sites and sponsored search results to trick macOS users into running malware, using the lure of a popular OpenAI developer tool.

Campaign Discovery and Initial Lure

On August 24, Cato Networks published a technical write-up detailing how the campaign directed users from sponsored searches for queries like “codex macos download” to Google Sites pages impersonating an OpenAI Codex download portal.

The fake portal presented both macOS and Linux download options, but Cato observed active payload delivery only for macOS. The visible Google Sites pages served as the front end, embedding attacker-controlled content through an iframe. This allowed the operators to use a trusted hosting domain for the initial encounter while keeping the active ClickFix content on separate infrastructure.

Layered Evasion and Gating

Cato identified three infrastructure sets, with the third reusing an iframe host seen in the first. A second set employed a simple evasion: the active ClickFix page was served from an unexpected path, while the more intuitive one returned a benign fake product page.

The campaign also observed benign content when the Google Sites lure was opened from a non-macOS device. This path- and operating-system-aware gating could cause automated analysis or researchers to receive a harmless page instead of the active lure, reducing the chance of detection.

ClickFix Infection Chain

The fake installer instructed victims to open Terminal and paste a command presented as a legitimate-looking Codex installation. Behind the scenes, the command decoded an encoded URL and retrieved a shell script that continued the infection chain.

The chain ran through three stages, ending in the Mach-O payload. The pasted command retrieved a shell-script loader, which decoded and executed a second-stage script, which in turn fetched the Mach-O. Cato noted that the loader became more heavily encrypted and obfuscated between infrastructure sets, while the second stage recorded that a victim had pasted the command before retrieving the final payload.

Before launching the payload, the second stage staged it in /tmp/helper and stripped the file's extended attributes, removing the download-related quarantine metadata that normally triggers macOS warnings about files retrieved from the internet.

Overlap with Known AMOS Chain

Cato Networks found substantial similarities between the campaign's delivery framework and a previously documented Atomic macOS Stealer (AMOS) infection chain. These similarities include encoded shell loaders, telemetry requests, update-themed payload retrieval, and universal Mach-O payloads built to run on both Intel and Apple Silicon Macs, staged in /tmp/helper.

The researchers said the overlap was strong and consistent with AMOS delivery activity, rather than presenting it as proof that the final payload was AMOS. They cautioned specifically that the delivery telemetry should not on its own be read as evidence of how the Mach-O behaves once it runs.

Quantifying the Threat

• Three infrastructure sets identified in the campaign
• Three-stage infection chain ending in a Mach-O payload
• Stage two staged the payload in /tmp/helper

Implications for Defenders

The findings fit a wider expansion of AI-tool impersonation and ClickFix campaigns targeting users through trusted platforms and familiar developer workflows. For defenders, Cato Networks said detecting the campaign required correlating sponsored-search delivery, embedded web content, Terminal execution, and outbound activity rather than relying on any single indicator.

This campaign underscores that attackers are increasingly blending social engineering with legitimate services to distribute malware. By abusing Google Sites and sponsored ads, they lower user suspicion and make detection harder for security tools that don't look at the full picture.