Attackers bought the top result for "codex macos download" and kept the payload swappable

Cato Networks reported Monday that a fake Codex macOS installation page uses ClickFix techniques and trusted Google Sites domains to deliver a payload suspected to be the Atomic macOS Stealer (AMOS), an infostealer.

Cato Networks published its technical write-up of the campaign on August 24.

The ad links to a Google Sites page showing a fake Codex download portal through an iframe that embeds content from a separate malicious domain, letting the attacker control and modify the malicious content without editing the Google Site or hosting malicious content on it.

The chain ran through three stages ending in the Mach-O payload, and the second stage recorded that a victim had pasted the command before retrieving the final payload.

The final payload is a Mach-O binary suspected to be AMOS based on similarities with previous AMOS campaigns, including event=pasted delivery telemetry, /tmp/helper staging, base64-encoded curl loaders, removal of extended attributes and uniquely structured update URLs.

Cato Networks said the overlap with a previously documented AMOS infection chain was strong and consistent with AMOS delivery activity, rather than presenting it as proof that the final payload was AMOS, and cautioned that delivery telemetry should not on its own be read as evidence of how the Mach-O behaves once it runs.

Newer versions of the Google Sites lure serve benign content when visited from non-macOS devices, and serve benign content at the /codex/ path while the ClickFix lure is served at /codexx/.

Cato researchers wrote that path- and operating-system-aware gating can mislead analysts and automated scanners, and that a request not matching the intended path or macOS target profile may never receive the ClickFix content.

The fraudulent installation page appears in sponsored results for search terms related to installing OpenAI's Codex coding tool for macOS, including "codex macos download", and the sponsored result appears at the top of search results, above the legitimate OpenAI page.

The macOS download portal presents a command to paste into Terminal that begins with echo followed by a seemingly legitimate "npm install" string; the full command retrieves a malicious shell script from a base64-encoded URL and executes it with zsh.

In an earlier version the embedded second-stage script was compressed and base64-encoded; in later versions it is embedded as an AES-encrypted gzip container with its decryption key reconstructed from several variables, making reverse engineering harder.

The fake portal offered both macOS and Linux download options, but researchers observed active payload delivery only for macOS.

Cato said detection depends on correlating search delivery, embedded content, Terminal execution and outbound activity rather than relying on any single indicator.

Cato researchers concluded that abuse of both Google Search and Google Sites creates a scenario where "trust becomes the payload", as "no single stage reliably exposes the attack".

Cato's report notes that some infrastructure used in the Codex campaign has also been used in Claude Code-themed campaigns, though those pages were not hosted on Google Sites.

The Mach-O payloads staged in /tmp/helper are universal binaries, built to run on both Intel and Apple Silicon Macs.

In May, Cyderes' Howler Cell reported on a ClickFix and Google Ads malvertising campaign targeting Windows users who searched for "Claude Code install".

In March, Push Security disclosed a similar "InstallFix" campaign spreading the Amatera infostealer to both Windows and macOS users searching for "Claude Code install", "Claude Code CLI" and "install claude code".

Because the malicious content is hosted off Google, removing the Google Site does not remove the ClickFix host, and blocking the ClickFix host leaves the sponsored ad and the trusted Google Sites front end in place.

Because the paste is reported to the operator before the final payload is downloaded, the operator gains delivery telemetry regardless of whether the payload is retrieved or executes successfully.

The Google Sites front end is an addition to infrastructure already in use for Claude Code-themed lures rather than a standalone build.

At least four different infrastructure sets were found across the Codex ClickFix campaign, with different obfuscation techniques used for the second-stage loader between infrastructure changes.

Cato identified three infrastructure sets, the third of which reused an iframe host seen in the first.

The two published accounts of the same Cato report differ on the number of infrastructure sets: at least four in one, three in the other, a gap of at least one set.