Published · 13h agoSecurity2 min read
Cato Networks says a sponsored ad outranked OpenAI's own page, sending macOS developers to a Google Sites portal whose ClickFix content lives on infrastructure Google never hosted.
Not a builder's beat, but builders have a standing stake in it.
Compiled by The WatchSomething wrong?How this is made
Cato's write-up is dated August 24 [2]. The iframe is the load-bearing part of what it describes. None of the malicious content sits on the Google Site, so the operator can rewrite the pasted command and the loader behind it without editing the page Google serves [4]. Cato's Jakub Osmani and Guy Waizel describe this as combining a trusted hosting domain with independently controlled ClickFix content [5]. The practical effect is that abuse handling splits in two: a report to Google removes a front end that costs nothing to rebuild, and a block on the payload host leaves the ad and the trusted domain working [24].
The content did get rewritten. In earlier infrastructure the embedded second stage was compressed and base64-encoded; in later versions it arrives as an AES-encrypted gzip container whose decryption key is reassembled from several variables [15]. SC Media reports at least four infrastructure sets, with the obfuscation of the second-stage loader changing between them [12]. The portal also advertised a Linux download, though Cato observed active payload delivery only for macOS [18], and the final binary is universal, so Intel and Apple Silicon hosts both run it [26].
Before the Mach-O is fetched, the second stage sends a request carrying event=pasted to an attacker-controlled endpoint [7], which Infosecurity Magazine describes as recording the paste ahead of payload retrieval [9]. That is campaign measurement rather than malware behaviour: the operator learns which searches produced someone willing to paste into Terminal, whether or not the payload lands or runs [25]. The same stage clears extended attributes with xattr -c [7], stripping the download quarantine metadata that normally triggers macOS warnings about files retrieved from the internet [8].
None of this tradecraft is new to AI tooling. Cyderes' Howler Cell reported in May on a ClickFix and Google Ads campaign aimed at Windows users searching for "Claude Code install" [21], and Push Security disclosed in March an "InstallFix" campaign spreading the Amatera infostealer to Windows and macOS users searching similar terms [22]. Cato says some infrastructure in the Codex campaign has also served Claude Code-themed pages that were not hosted on Google Sites [23], which makes the Sites front end an addition to a working kit rather than a new one [27]. The researchers' own summary is that trust becomes the payload, because no single stage reliably exposes the attack [20].
Ranked by verification strength, evidence, and original report placement.
Cato Networks reported Monday that a fake Codex macOS installation page uses ClickFix techniques and trusted Google Sites domains to deliver a payload suspected to be the Atomic macOS Stealer (AMOS), an infostealer.
Cato Networks published its technical write-up of the campaign on August 24.
The fraudulent installation page appears in sponsored results for search terms related to installing OpenAI's Codex coding tool for macOS, including "codex macos download", and the sponsored result appears at the top of search results, above the legitimate OpenAI page.
The ad links to a Google Sites page showing a fake Codex download portal through an iframe that embeds content from a separate malicious domain, letting the attacker control and modify the malicious content without editing the Google Site or hosting malicious content on it.
"This separation lets the attacker combine a trusted hosting domain with independently controlled ClickFix content," wrote Cato Networks Research Engineer Jakub Osmani and Tech Evangelist Guy Waizel.
The macOS download portal presents a command to paste into Terminal that begins with echo followed by a seemingly legitimate "npm install" string; the full command retrieves a malicious shell script from a base64-encoded URL and executes it with zsh.
The reporting this story was synthesized from, earliest first. Every link goes to the original.
