Fake OpenAI Codex ads deliver malware to Mac developers
Researchers uncover new malicious campaign targeting developers through sponsored search results
1Luring victims with fake download pages
Cybercriminals are targeting developers searching for OpenAI Codex for Mac. Sponsored Google search results redirect users to convincing fake download pages. These pages mimic OpenAI's official branding and design to appear legitimate. Instead of providing a download, victims are instructed to run terminal commands that initiate the malware infection process.
2Multi-stage malware delivery chain
The command victims are told to paste initially appears as a legitimate npm instruction. However, it contains a Base64-encoded URL that fetches an attacker-controlled shell script. This script downloads a second stage that connects to the attacker's server. The final payload is a Mach-O executable placed in '/tmp/helper' location on the victim's system.
3Bypassing macOS security measures
The malware removes security attributes that macOS uses to flag suspicious downloads. This allows it to avoid the system's usual warning prompts. Researchers found the malicious binaries are universal Mach-O files, compatible with both Intel and Apple Silicon processors. The cross-platform compatibility increases the potential victim pool significantly.
4Connections to Atomic macOS Stealer
Cato Networks researchers identified significant similarities between this campaign and AMOS (Atomic macOS Stealer). The attack staging and final payload structure match techniques previously seen in AMOS infections. However, researchers caution that it's too early to definitively attribute this to AMOS. The info-stealer has historically spread through fake software downloads and malvertising campaigns.
5Anti-analysis defenses in place
Attackers have implemented measures to hinder researcher investigation. While the initial landing page is hosted on Google Sites, malicious content is loaded via iframe from attacker-controlled infrastructure. The infrastructure checks visitor details like OS and referral path, only delivering malware to targeted users. Others receive harmless-looking content, making analysis more difficult.
6Multiple AI coding assistants targeted
Researchers discovered a similar ClickFix page impersonating Anthropic's Claude Code, sharing infrastructure with the Codex campaign. This suggests attackers are expanding their operation to target users of different AI coding assistants. Developers' Google searches for these tools effectively do the targeting work for the attackers, with sponsored ads pushing fake downloads.
7The role of sponsored ads
Attackers are effectively leveraging Google's sponsored ad system. Fake download pages appear at the top of search results for terms like 'OpenAI Codex download.' This placement above organic results increases the likelihood of victims falling for the scam. Users' trust in sponsored listings contributes to the campaign's effectiveness.
8Critical warnings for developers
This incident highlights the need for developers to exercise caution with download links from sponsored ads. Verifying sources before executing terminal commands is crucial. As AI coding assistants grow in popularity, similar attacks are expected to increase. Users should only download software from official sources and avoid executing suspicious commands from untrusted sites.