Fake Codex installer tricks Mac users into pasting malware, Cato finds

A new macOS attack campaign has been uncovered, utilizing a deceptive OpenAI Codex installer to trick users into executing malware. The scheme begins with a sponsored Google search result that mimics the official OpenAI Group PBC listing. By clicking the ad, users are directed to a page on Google Sites, which closely resembles the legitimate Codex download portal. However, the actual malicious content is delivered through an iframe hosted on a separate Google static-content proxy.

Researchers from Cato Networks discovered three distinct infrastructure sets used in this campaign. The initial lure is hosted at /codexx/, while the more obvious /codex/ path leads to a harmless product page. When macOS users visit the intended path, they are presented with a malicious installer. The installer guides the user through opening Terminal and pasting a command that appears to be a legitimate npm install string for Codex.

Once the command is executed, it decodes a Base64 URL and injects a remotely retrieved script into the zsh shell. The attack consists of three stages. The first stage is a shell-script loader, which contains dead code and unused variables, wrapped around an encoded blob that is decoded and executed using eval. The second stage is revealed at this point, and it sends telemetry data to an attacker endpoint with the event=pasted, indicating that the malicious command has been run.

The final payload is then downloaded to the /tmp/helper directory, with its extended attributes cleared to avoid the usual warning message that appears with downloaded files. The loader has undergone modifications in different infrastructure sets, with newer versions using an AES-encrypted gzip container and rebuilding the decryption key from scattered variables within the script.

Cato Networks has identified this campaign as strongly linked to Atomic macOS Stealer, also known as AMOS, due to similarities in loader URL structure, telemetry requests, staging paths, and payload URLs. This malware payload is universal and runs on both Intel and Apple Silicon Macs. Cato has blocked the reused iframe host behind the latest Google Sites lure and is closely monitoring the operators' domain and payload rotation.