Fake Codex installer outranks OpenAI in Google ads, then asks for a paste

Every surface the victim touches before the malware lands belongs to someone with a good reputation. The entry point is a paid Google search result that sits above OpenAI's own listing for queries such as "codex macos download" ^[3]. The landing page is on Google Sites and reproduces the Codex download portal down to the macOS and Linux buttons ^[4]. The attacker's live content arrives inside an iframe that Cato says is probably routed through a Google static-content proxy ^[1]. Count the hops and three of them are Google-operated properties ^[16].

That last one is the operational detail. Cato found no malicious code on the Google Sites page itself, so the page a reviewer inspects can stay unchanged while the ClickFix instructions behind the iframe are swapped out ^[1]. The lure is decoupled from the hosting reputation it borrows.

The command the page asks for opens with a plausible npm install string for Codex, then decodes a Base64 URL and pipes a retrieved script into zsh ^[6]. Stage one is padded with dead code and unused variables around an encoded blob it hands to eval, and stage two's first act is a request to an attacker endpoint carrying event=pasted ^[7]. That is conversion tracking. The operators learn how well the lure copy performs before they learn whether the payload ran.

What follows is ordinary. The script pulls the final payload to /tmp/helper, runs xattr -c to clear its extended attributes, makes it executable and launches it, and clearing those attributes removes the download quarantine metadata that would normally put a warning in front of the user ^[8]. Nothing was exploited. The user supplied the privilege by typing past it. Cato ties the framework to Atomic macOS Stealer on loader URL structure, the telemetry request, the /tmp/helper staging path, the attribute removal and update-themed payload URLs, calling the match strong without naming the final binary ^[10][11]. It ships as a universal Mach-O, so Apple Silicon is no barrier ^[11].

The evasion is aimed at whoever checks. The live ClickFix page sits at /codexx/ while the obvious /codex/ path returns a harmless product page, and non-macOS visitors are served benign content too ^[5]. An analyst who guesses the intuitive URL, or looks from a Linux box, sees a clean site. Cato's own conclusion is that no single stage reliably exposes the attack and detection depends on correlating search delivery, embedded content, Terminal execution and outbound activity ^[14]. That is four telemetry sources to join, on the one class of endpoint where pasting shell commands is routine work.

Cato notes that several campaigns this year have dressed delivery in AI developer tooling ^[15]. The artifact worth controlling is the install instruction itself: if the canonical command for a tool lives in an internal document and nowhere else, a search ad has nothing to sell. Blocking hosts is the slower track. The loader has already been reworked between infrastructure sets, with early samples compressing and Base64-encoding the second stage and newer ones using an AES-encrypted gzip container whose key is rebuilt from variables scattered through the script ^[9], and Cato says it blocked the reused iframe host while the operators keep rotating domains and payload locations ^[13].