Fake OpenAI Codex Ads Lead Mac Developers into ClickFix Malware Scheme

Cato Networks identified a malicious operation that leverages paid Google search results to present bogus OpenAI Codex download pages to Mac developers. The counterfeit site, hosted on Google Sites and styled with OpenAI branding, asks users to run a terminal command that appears to install Codex via npm but actually decodes a Base64 URL, pulls an attacker-controlled script, and pipes it into zsh. This script contacts the criminals’ server, reports the victim’s click, and retrieves a universal Mach-O executable placed in /tmp/helper, which then suppresses macOS security alerts before executing.

The final binaries can run on both Intel-based and Apple Silicon Macs and show strong similarities to the Atomic macOS Stealer (AMOS) infostealer, though Cato stops short of labeling it as such. The malicious page loads its content through an iframe from attacker-controlled infrastructure that tailors the experience based on the visitor’s OS, showing benign content to non-targeted users. Researchers also uncovered a parallel ClickFix page masquerading as Anthropic’s Claude Code, sharing the same backend, indicating a broader campaign against AI coding assistants.