Attackers bought the top result for "codex macos download" and kept the payload swappable

Cato's write-up is dated August 24 ^[2]. The iframe is the load-bearing part of what it describes. None of the malicious content sits on the Google Site, so the operator can rewrite the pasted command and the loader behind it without editing the page Google serves ^[4]. Cato's Jakub Osmani and Guy Waizel describe this as combining a trusted hosting domain with independently controlled ClickFix content ^[5]. The practical effect is that abuse handling splits in two: a report to Google removes a front end that costs nothing to rebuild, and a block on the payload host leaves the ad and the trusted domain working ^[24].

The content did get rewritten. In earlier infrastructure the embedded second stage was compressed and base64-encoded; in later versions it arrives as an AES-encrypted gzip container whose decryption key is reassembled from several variables ^[15]. SC Media reports at least four infrastructure sets, with the obfuscation of the second-stage loader changing between them ^[12]. The portal also advertised a Linux download, though Cato observed active payload delivery only for macOS ^[18], and the final binary is universal, so Intel and Apple Silicon hosts both run it ^[26].

Before the Mach-O is fetched, the second stage sends a request carrying event=pasted to an attacker-controlled endpoint ^[7], which Infosecurity Magazine describes as recording the paste ahead of payload retrieval ^[9]. That is campaign measurement rather than malware behaviour: the operator learns which searches produced someone willing to paste into Terminal, whether or not the payload lands or runs ^[25]. The same stage clears extended attributes with xattr -c ^[7], stripping the download quarantine metadata that normally triggers macOS warnings about files retrieved from the internet ^[8].

None of this tradecraft is new to AI tooling. Cyderes' Howler Cell reported in May on a ClickFix and Google Ads campaign aimed at Windows users searching for "Claude Code install" ^[21], and Push Security disclosed in March an "InstallFix" campaign spreading the Amatera infostealer to Windows and macOS users searching similar terms ^[22]. Cato says some infrastructure in the Codex campaign has also served Claude Code-themed pages that were not hosted on Google Sites ^[23], which makes the Sites front end an addition to a working kit rather than a new one ^[27]. The researchers' own summary is that trust becomes the payload, because no single stage reliably exposes the attack ^[20].