Developers who search Google for OpenAI’s Codex coding assistant are finding sponsored results that lead to a fake download page and, eventually, macOS-stealing malware.
Security researchers at Cato Networks traced the campaign to a convincing Google Sites page carrying OpenAI branding. Instead of an installer, the page tells Mac users to open Terminal and paste a command. The string begins with what looks like a routine npm install step for Codex, then quietly decodes a Base64 URL, pulls an attacker-controlled shell script, and pipes it into zsh.
That first stage phones home before fetching a Mach-O executable dropped at /tmp/helper. The chain also strips the metadata macOS uses to mark internet downloads, so the usual Gatekeeper warnings never fire. The final binaries are universal, built to run on both Intel Macs and Apple Silicon.
Cato says the staging and payload construction carry strong fingerprints of Atomic macOS Stealer, the infostealer known as AMOS, though it stops short of confirming the family. A matching ClickFix page impersonating Anthropic’s Claude Code shared infrastructure with this one, and the fake content is loaded through an iframe from attacker infrastructure that checks the visitor’s operating system and route before showing anything.
The scam leans on ad placement to skip the hard part: sponsored links sit above the real Codex results, and victims run the infection command themselves.
