Attackers ran sponsored search ads that led macOS users to a fake “OpenAI Codex” download page hosted on Google Sites. The site used “ClickFix” style instructions to convince victims to open Terminal and paste a command that quietly downloaded and ran a multi-stage macOS malware chain.
Attackers placed sponsored search ads targeting queries such as codex macos download. Clicking these ads sent macOS users to a page hosted on Google Sites that impersonated an OpenAI Codex download portal. Rather than delivering a direct installer file, the page used ClickFix style instructions, telling visitors to open Terminal and paste a command to complete installation.
That pasted command decoded a hidden URL and retrieved a shell script, which continued a multi-stage infection chain. The chain ran through three stages before ending in a Mach-O payload. Before execution, the payload was staged in a temporary directory and its extended attributes were stripped, removing the quarantine metadata that normally triggers macOS warnings about internet-downloaded files.
The campaign relied on several layers of trust manipulation rather than a single trick:
Together, these elements made the page look legitimate at a glance and reduced the chances that a victim, or a reviewer, would notice anything wrong before the payload executed.
Organizations with macOS users, especially developers and engineering teams who frequently install command-line tools, should reinforce a few habits: navigate directly to official vendor sites rather than clicking sponsored search results, treat any request to paste a Terminal command from a webpage as a red flag unless the source is verified, and report suspicious installers even when no security warning appears, since this campaign specifically stripped the metadata that would normally trigger one. IT support and helpdesk staff should be briefed on this pattern so they can recognize and escalate similar reports quickly.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Sponsored search results for terms like codex macos download led victims to a Google Sites page impersonating an OpenAI Codex download portal, which used ClickFix style instructions to get users to open Terminal and paste a command.
The command decoded a hidden URL and retrieved a shell script that continued a multi-stage infection chain, ultimately downloading a Mach-O payload while stripping quarantine metadata to avoid macOS security warnings.
No, the report describes attackers embedding attacker-controlled content via an iframe so the trusted Google Sites domain hosted the initial page while the active malicious content lived on separate infrastructure.
Developers, engineering teams, IT support staff, and general macOS users who search for and download developer tools are the primary targets described.
You search “codex macos download,” click the top sponsored result, and land on a slick “OpenAI Codex” page on Google Sites. The page says Codex needs a manual install: it shows a big code block and tells you, “Open Terminal on your Mac and paste this command to install Codex.” That one paste silently pulls down scripts and a Mach-O malware payload. Here’s the trap: real OpenAI tools don’t install from a random Google Sites page, and legit installers don’t make you paste an opaque Terminal command that hides URLs, drops files in /tmp, then strips macOS quarantine so you never see a warning. If a download page tells you to paste a Terminal command from the web, stop. Close it, go directly to the vendor’s official site yourself, and download from there instead.
Attackers used a sponsored search ad to send macOS users to a fake “OpenAI Codex download” page hosted on Google Sites. The page convinced victims to open Terminal and paste a command that secretly downloaded and ran a multi-stage malware infection.
Attackers are buying sponsored Google search ads that send Mac developers to fake OpenAI Codex download pages. The pages instruct victims to paste a Terminal command that looks like a normal install step, but actually downloads and runs a multi-stage malware payload.
Check Point researchers demonstrated a real proof-of-concept where a victim’s ChatGPT session could be tricked into running hidden, attacker-controlled tasks in parallel with the user’s normal request. In the demo, the attacker used a covert cross-account channel to make ChatGPT access the victim’s…
Researchers demonstrated a technique that can trick xAI’s Grok into leaking a user’s chat prompts and some session details to an attacker-controlled server when the user asks Grok to summarize a web page. The attack hides malicious instructions inside encrypted content on the page, which Grok is…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Zenity demonstrated real-world attack chains where hidden instructions in emails or content on X can hijack AI “agentic browsers” (ChatGPT Atlas and the Claude Chrome extension). In the demos, the AI agent can be steered to perform actions in the user’s already logged-in sessions, sending phishing…
