Crooks push Mac malware through fake OpenAI Codex ads

Cybercriminals are employing deceptive tactics to distribute malware disguised as installation commands for OpenAI's Codex on macOS. Researchers from Cato Networks discovered this campaign after identifying fraudulent Google search results aiming to lure developers seeking Codex for macOS. These fraudulent ads direct potential victims to a seemingly legitimate download page hosted on Google Sites, adorned with familiar OpenAI branding.

However, the faux download site does not deliver the promised installer. Instead, it prompts Mac users to open Terminal, input a supplied command, and execute it. This command appears to be part of the installation process, but it covertly initiates a multi-stage malware infection. This approach adopts the prevalent "ClickFix" technique, wherein attackers prompt victims to execute malicious commands themselves rather than relying on a malicious attachment or executable.

The command initiates with what seems to be a legitimate npm instruction for installing Codex. However, it is complemented with code that decodes a Base64-encoded URL, retrieves an attacker-controlled shell script, and pipes it into zsh. This script fetches an additional stage, which communicates with the attacker's server to signal infiltration before downloading a Mach-O executable to "/tmp/helper".

The malware then suppresses security information that macOS typically employs to flag suspicious downloads, thereby evading typical warnings and allowing the malware to operate undetected.

Cato revealed that the concluding binaries are universal Mach-O files, enabling them to operate natively on both Intel-powered Macs and newer Apple Silicon machines. The researchers noticed significant similarities between this campaign and Atomic macOS Stealer, also known as AMOS, an infostealer that was previously disseminated through fake software downloads and malicious advertising campaigns.

While Cato has not officially classified the malware as AMOS, many indicators suggest a strong connection, from the attack staging to the construction of the final payload.

To deter researchers from scrutinizing their malicious code, the perpetrators have implemented measures to obfuscate their operations. Although victims initially land on Google Sites, the malicious content is fetched from attacker-controlled infrastructure via an iframe. This infrastructure adjusts its display based on details such as the visitor's operating system and the path used to reach the site, thus presenting innocuous content to visitors that do not match the attackers' targets.

Cato noted that the decoy site presented both macOS and Linux download options, although they only observed the malware chain being delivered to Mac users. Codex is not the sole AI coding assistant being used for such malicious purposes. During their investigation, Cato identified a similar ClickFix page falsely representing Anthropic's Claude Code.

This campaign shares infrastructure with the Codex campaign. The attackers do not need to exert much effort to find their victims, as developers searching Google for Codex facilitate this process by pushing the fraudulent download page above the legitimate results.