Researchers described a real macOS malware campaign that tricks people searching for “Codex macos download” into clicking a sponsored Google result and landing on a fake OpenAI Codex download site. Victims are then coached to open Terminal and paste a command that fetches and runs malware (a “ClickFix” style social-engineering flow). The activity is strongly linked to Atomic macOS Stealer (AMOS), and the attack is designed to hide from scanners and non‑Mac visitors.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You search “codex macos download,” click the top Google result, and boom, you're on a slick Codex download page. Looks legit, right? But this is a fake Codex portal. On macOS, it walks you through opening Terminal and pasting a long 'npm install' style command that secretly decodes a Base64 URL and pipes a remote script straight into zsh. Paste it, and behind the scenes it phones home 'event=pasted', pulls a payload into /tmp/helper, strips macOS quarantine with xattr -c, makes it executable, and runs what researchers link to Atomic macOS Stealer, or AMOS. Here’s the move: if a website tells you to paste a long Terminal command to install Codex or any app, stop and close the tab, then only install from openai.com or your normal app store.
A real ClickFix campaign used 250+ lookalike domains and browser fingerprinting to show malware lures mainly to real macOS visitors while showing harmless decoys to scanners and researchers. Victims were pushed to copy and run an obfuscated command in macOS Terminal, which then downloaded and…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Researchers reported a real phishing campaign (“Operation BlueDash”) that tricks users with a “secure document” lure and routes them to a fake Microsoft Store page that claims Microsoft Teams must be updated. The download installs legitimate remote access tools (Level RMM and ScreenConnect) so…
Researchers found a new macOS infostealer, “ClickLock Stealer,” that uses ClickFix-style fake verification pages to trick people into running Terminal commands. After infection, it shows a realistic macOS password prompt and can effectively lock the Mac until the victim enters the correct password,…
