Attackers ran sponsored search ads that led macOS users to a fake “OpenAI Codex” download page hosted on Google Sites. The site used “ClickFix” style instructions to convince victims to open Terminal and paste a command that quietly downloaded and ran a multi-stage macOS malware chain.
Attackers placed sponsored search ads targeting queries such as codex macos download. Clicking these ads sent macOS users to a page hosted on Google Sites that impersonated an OpenAI Codex download portal. Rather than delivering a direct installer file, the page used ClickFix style instructions, telling visitors to open Terminal and paste a command to complete installation.
That pasted command decoded a hidden URL and retrieved a shell script, which continued a multi-stage infection chain. The chain ran through three stages before ending in a Mach-O payload. Before execution, the payload was staged in a temporary directory and its extended attributes were stripped, removing the quarantine metadata that normally triggers macOS warnings about internet-downloaded files.
The campaign relied on several layers of trust manipulation rather than a single trick:
Together, these elements made the page look legitimate at a glance and reduced the chances that a victim, or a reviewer, would notice anything wrong before the payload executed.
Organizations with macOS users, especially developers and engineering teams who frequently install command-line tools, should reinforce a few habits: navigate directly to official vendor sites rather than clicking sponsored search results, treat any request to paste a Terminal command from a webpage as a red flag unless the source is verified, and report suspicious installers even when no security warning appears, since this campaign specifically stripped the metadata that would normally trigger one. IT support and helpdesk staff should be briefed on this pattern so they can recognize and escalate similar reports quickly.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Sponsored search results for terms like codex macos download led victims to a Google Sites page impersonating an OpenAI Codex download portal, which used ClickFix style instructions to get users to open Terminal and paste a command.
The command decoded a hidden URL and retrieved a shell script that continued a multi-stage infection chain, ultimately downloading a Mach-O payload while stripping quarantine metadata to avoid macOS security warnings.
No, the report describes attackers embedding attacker-controlled content via an iframe so the trusted Google Sites domain hosted the initial page while the active malicious content lived on separate infrastructure.
Developers, engineering teams, IT support staff, and general macOS users who search for and download developer tools are the primary targets described.
You search “codex macos download,” click the top sponsored result, and land on a slick “OpenAI Codex” page on Google Sites. The page says Codex needs a manual install: it shows a big code block and tells you, “Open Terminal on your Mac and paste this command to install Codex.” That one paste silently pulls down scripts and a Mach-O malware payload. Here’s the trap: real OpenAI tools don’t install from a random Google Sites page, and legit installers don’t make you paste an opaque Terminal command that hides URLs, drops files in /tmp, then strips macOS quarantine so you never see a warning. If a download page tells you to paste a Terminal command from the web, stop. Close it, go directly to the vendor’s official site yourself, and download from there instead.
Attackers used a sponsored search ad to send macOS users to a fake “OpenAI Codex download” page hosted on Google Sites. The page convinced victims to open Terminal and paste a command that secretly downloaded and ran a multi-stage malware infection.
A real ClickFix campaign abused ChatGPT “Custom GPTs” to impersonate legitimate tools and trick people into running PowerShell commands on their own computers. Victims were funneled from a sponsored Google result to a fake “backup domain” on Google Sites with a Cloudflare CAPTCHA-style prompt,…
Researchers observed threat actors creating attacker-made ChatGPT Custom GPTs that look legitimate, then steering users to a Google Sites “backup domain.” Victims are shown a fake Cloudflare CAPTCHA that tricks them into copying and running a malicious PowerShell command, which downloads and runs…
Attackers are buying sponsored Google search ads that send Mac developers to fake OpenAI Codex download pages. The pages instruct victims to paste a Terminal command that looks like a normal install step, but actually downloads and runs a multi-stage malware payload.
Attackers are using sponsored Google ads to route people to a malicious “custom GPT” that looks like ChatGPT, even while the user is logged in on the real ChatGPT domain. The fake GPT displays a convincing “service availability” message and pushes a link to a “backup domain” that ultimately…
Researchers found a real malware campaign where attackers abused ChatGPT “CustomGPTs” and Google sponsored search results to funnel victims to a fake ChatGPT experience. Victims are shown a fake “Service Availability Notice” and pushed to a “backup domain” that looks like a Cloudflare CAPTCHA,…
