The trust an organization places in a familiar developer-tool brand is now a delivery mechanism for malware. Researchers at Cato Networks documented a campaign that buys sponsored search results for queries like “codex macos download,” positioning a fake OpenAI Codex installer above the real OpenAI listing. The ad leads to a page built on Google Sites, a legitimate no-code hosting service, which then serves a fake installer and a Terminal command through the ClickFix technique: rather than downloading a file, the victim is talked into pasting and running the attacker’s command themselves.
Once executed, the command kicks off a multi-stage delivery chain that Cato assessed shares strong overlap with the publicly documented Atomic macOS Stealer. Cato tracked at least four separate infrastructure sets behind the campaign, with hosting and payload domains rotating while some components, including a distinctive payload-retrieval URL path, were reused across versions, evidence of a single operation iterating rather than several unrelated actors. One of the later infrastructure sets used a landing page built to impersonate not Codex but Claude Code, Anthropic’s coding assistant, showing the technique is being extended to whichever AI development tool is currently drawing developer search traffic.
The original insight for security leaders is not “watch out for fake software downloads,” which every employee has heard for years. It is that the abuse now runs through the trust chain organizations rely on to vet software: a paid ad ranks above the legitimate result, the landing page sits on a domain Google itself operates, and the install step is dressed as a normal command-line step a developer would expect for a coding tool. Blocking by domain reputation alone will not catch a campaign built to rotate infrastructure faster than blocklists update; teams should treat any Terminal command a user is asked to paste from a web page as a red flag regardless of how legitimate the source page appears, and extend awareness training beyond “don’t download the exe” to cover ClickFix specifically.
Related coverage: Fake npm Packages Hid an AI-Directed Backdoor and SilkParasite Spies Used AI to Build Faster Malware.
