Fake OpenAI Codex ads deliver malware to Mac users
Researchers uncover new malware campaign spreading through sponsored Google ads.
1Campaign discovery
Cato Networks researchers detected sponsored Google ads targeting users looking to download OpenAI Codex for macOS. These ads redirect users to a fake download page hosted on Google Sites. While the page is designed with OpenAI's recognizable branding, it actually aims to execute a malicious command instead of providing Codex. Such 'ClickFix' techniques are becoming increasingly popular among cybercriminals recently.
2Malware operation
Victims are instructed to open Terminal and run a provided command. The command initially appears as a legitimate npm instruction but actually decodes a Base64-encoded URL. This URL fetches an attacker-controlled shell script and pipes it into zsh. The script connects to the attacker's server in the second stage and downloads a Mach-O executable to '/tmp/helper'. It also removes security information macOS uses to flag suspicious downloads.
3Targeted systems
Researchers determined that the final binaries are universal Mach-O files, meaning the malware can run seamlessly on both Intel-based Macs and newer Apple Silicon machines. The campaign's technical details show significant similarities with Atomic macOS Stealer (AMOS), an infostealer previously spread through fake software downloads and malicious ads. However, Cato states it's too early to confirm an AMOS connection definitively.
4Attackers' evasion techniques
The attackers have implemented various measures to make campaign analysis difficult. Malicious content isn't served directly from Google Sites but loaded via an iframe from attacker-controlled infrastructure. This infrastructure checks visitor's OS and access path, showing harmless content to non-targeted users. Researchers noted the decoy site offered both macOS and Linux download buttons but only delivered malware to Mac users.
5Other AI assistants targeted
Codex isn't the only victim of such attacks. During their investigation, Cato discovered a similar ClickFix page impersonating Anthropic's Claude Code, sharing infrastructure with the Codex campaign. Attackers don't need to work hard to find victims, as developers searching for Codex on Google are directly redirected to fake download pages through sponsored ads positioned above legitimate results.
6The rise of ClickFix technique
Unlike traditional malware distribution methods, ClickFix relies on victims executing malicious commands themselves. This technique bypasses suspicious attachments or executables by gaining the victim's trust and directly manipulating the command line. Particularly effective against technically skilled users, this method is becoming increasingly successful at bypassing security measures.
7Potential impacts and risks
Such campaigns threaten not only individual users but corporate networks as well. Malware compromising a developer's machine could spread across entire company infrastructure. CI/CD pipelines used in software development processes may be especially vulnerable to these threats. With the growing popularity of AI coding assistants, experts anticipate these attacks will continue to diversify and evolve.
8Recommendations for users
Security experts recommend developers only download software from official sources and carefully examine commands before execution in Terminal. Being skeptical of sponsored search results and using browser security extensions are also important protective measures. For enterprise users, network monitoring solutions and endpoint protection systems can provide additional defense layers against such advanced threats.