Codex ClickFix installation lure spreads suspected AMOS infostealer

A fake Codex macOS installation page uses ClickFix techniques and trusted Google Sites domains to deliver a payload suspected to be the Atomic macOS Stealer (AMOS), Cato Networks reported Monday.

The fraudulent installation page appears in sponsored results for search terms related to installing OpenAI’s Codex AI-powered coding tool for macOS, including “codex macos download.”

The sponsored result appears at the top of search results, above the legitimate OpenAI page. The ad links to a Google Site page with a fake Codex download portal displayed through an iframe that embeds content from a separate malicious domain.

This use of iframes enables the attacker to control and modify the malicious content without editing the Google Site or hosting any malicious content directly on the Google Site.

“This separation lets the attacker combine a trusted hosting domain with independently controlled ClickFix content,” Cato Networks Research Engineer Jakub Osmani and Tech Evangelist Guy Waizel wrote in a blog post.

The macOS download portal presents a command for users to paste into Terminal to supposedly install Codex, which begins with echo followed by a seemingly legitimate “npm install” string. In reality, the full command retrieves a malicious shell script from a base64-encoded URL and executes it with zsh.

The shell script acts as a loader containing an embedded blob that is decoded and executed with eval. This embedded second stage payload is another shell script that records the execution by sending a request with event=pasted to an attacker-controlled endpoint, downloads the final-stage payload to /tmp/helper, clears its extended attributes with xattr -c, makes the file executable using chmod +x and then launches it, Cato Networks researchers described.

The final payload is a Mach-O binary suspected to be AMOS stealer based on similarities with previous AMOS campaigns, including similar use of an event=pasted request for delivery telemetry, /tmp/helper staging of Mach-O payloads, the use of base64-encoded curl loaders, removal of extended attributes and the use of “uniquely structured update URLs,” Cato Networks stated.

At least four different infrastructure sets were found to be used across this Codex ClickFix campaign, with different obfuscation techniques used for the second-stage loader between infrastructure changes. In an earlier version, the embedded second stage script was compressed and base64-encoded, while in later versions, it is embedded as an AES-encrypted gzip container with its decryption key reconstructed from several variables, making reverse engineering more difficult, Cato noted.

Newer versions of the Google Sites lure infrastructure also attempt to evade detection by serving benign content when visited from non-macOS devices and also serving benign content at the /codex/ path while the ClickFix lure is served at the /codexx/ path.

“This path- and operating-system-aware gating can mislead analysts and automated scanners. A request that does not match the attacker’s intended path or macOS target profile may never receive the ClickFix content,” the Cato researchers wrote.

The abuse of trusted Google platforms — both Google Search and Google Sites — creates a scenario where “trust becomes the payload,” as “no single stage reliably exposes the attack,” the researchers concluded.

“Detection depends on correlating search delivery, embedded content, Terminal execution, and outbound activity,” the Cato blog post states.

AI tool downloads have become popular lures for similar ClickFix campaigns, often abusing sponsored search results to lead users to malicious sites. In May, Cyderes’ Howler Cell reported on ClickFix and Google Ads malvertising campaign targeting Windows users who searched for “Claude Code install.” In March, Push Security disclosed a similar “InstallFix” campaign spreading the Amatera infostealer to both Windows and macOS users searching for “Claude Code install”, “Claude Code CLI” and “install claude code.”

Cato’s report notes that some infrastructure used in the Codex campaign has also been used in Claude Code-themed campaigns, though these pages were not hosted on Google Sites.