- The Mess: Criminals are buying Google ads for searches like “codex macos download” and placing a fake Codex download page above the legitimate OpenAI result. The page looks convincing, but instead of installing Codex it tricks Mac users into opening Terminal and executing an attacker-controlled command.
This is ClickFix, and the trick is embarrassingly simple.
The victim sees what appears to be a normal software installation. No suspicious DMG screaming “I am malware.” No obvious executable attachment. Just instructions telling the user to copy a command into Terminal.
The command starts with something that looks like a legitimate npm install instruction. Then things get ugly.
It decodes a Base64-encoded URL, retrieves a shell script from infrastructure controlled by the attackers and pipes the result directly into zsh. The user has effectively become the malware loader.
The attackers also abuse Google Sites as the trusted-looking front end. The visible page itself does not need to contain the payload. An iframe pulls attacker-controlled content from elsewhere, allowing the operators to change the malicious infrastructure without rebuilding the lure page.
Researchers observed additional tricks designed to frustrate analysis. One infrastructure set served the malicious page through a less obvious /codexx/ path while /codex/ returned a harmless decoy. Non-Mac devices could also receive benign content.
That is not accidental sloppiness. It is filtering.
The final payload is a Mach-O binary suspected to be Atomic macOS Stealer (AMOS). The observed chain downloads it into /tmp/helper, removes extended attributes with xattr -c, makes it executable and launches it.
- The Damage: A successful infection can turn a developer’s Mac into a credential and data theft machine, with browsers, system information and potentially cryptocurrency-related data becoming targets.
And developers are an especially attractive target.
They have source-code repositories, cloud credentials, SSH keys, API tokens, browser sessions and access to production systems. Stealing one developer’s Mac credentials can be considerably more valuable than compromising a random home computer.
The attackers don’t even need to defeat macOS security directly.
They convince the owner to run the malware themselves.
That is the whole point of ClickFix.
- The Fix: Do not execute Terminal commands copied from search results or unofficial download pages; install Codex only from OpenAI’s legitimate channels, and if the command was already executed, isolate the Mac and investigate it for credential theft immediately.
Bugstoday Opinion
This campaign is a perfect example of why “I use a Mac, so I’m safe” is a terrible security strategy.
The attackers didn’t need a fancy zero-day.
They bought an advertisement.
They copied a website.
Then they asked the victim to press Enter.
That’s it.
The really nasty part is the trust chain. Google search results look trustworthy. Google Sites looks trustworthy. A page carrying OpenAI branding looks trustworthy. A Terminal command that starts with npm install looks technical enough to scare some users — and legitimate enough to fool others.
The computer isn’t necessarily the weakest link here.
The human is being turned into the execution engine.
Bugstoday verdict: if a “software installer” tells you to paste a mysterious command into Terminal, close the tab. You are not installing software. You are probably installing someone else’s problem.
