Attackers Use Fake Codex Ads to Target Macs

The attack relies on ClickFix, a social-engineering technique in which a user, rather than an installer, performs the command execution. Cato reported that the Google Sites page itself did not host malicious code. Instead, attacker-controlled content was embedded in an iframe, allowing the operators to update the fake installer content without modifying the visible Google Sites page.

According to Cato, the fake installer directs a victim to open Terminal and paste a command beginning with a plausible npm install string associated with Codex. The command decodes a Base64-encoded URL and pipes remotely retrieved content into zsh.

SiliconANGLE's account of Cato's findings describes a multistage sequence after execution:

• •A shell-script loader uses dead code, unused variables, and an encoded blob that is decoded and executed through eval.
• •The script sends a request containing event=pasted to an attacker-controlled endpoint before retrieving the final payload.
• •The final payload is downloaded to /tmp/helper, has extended attributes cleared with xattr -c, is made executable, and is launched.

Clearing extended attributes can remove macOS download-quarantine metadata, which would otherwise contribute to warning prompts for files obtained from the internet. Cato also reported changes between loader versions: earlier samples compressed and Base64-encoded a second stage, while newer samples used an AES-encrypted gzip container and reconstructed a decryption key from variables distributed through the script.

Cato identified three infrastructure sets and reported that some served benign content to non-macOS visitors. In one set, the active lure was hosted at /codexx/, while the more intuitive /codex/ path returned a harmless product page. This behavior can complicate validation by analysts and automated scanners because a request to the expected URL may not receive the malicious content.

Cato found strong overlap with publicly documented Atomic macOS Stealer, or AMOS, activity and assessed the campaign as likely related to the same operation. The report also cited newly introduced malicious advertising and reuse of infrastructure in that assessment.

For security teams, the incident illustrates a recurring delivery pattern: legitimate advertising platforms, trusted hosting services, and familiar developer brands can be combined with user-assisted execution to bypass controls focused only on downloaded executables.