Fake OpenAI Codex Downloads Target macOS Users via Google Sites and ClickFix
A malicious campaign has leveraged sponsored search results and legitimate Google Sites hosting to distribute macOS malware under the guise of an OpenAI Codex download. The attackers used operating-system-aware gating and iframes to evade detection while directing users to execute manual terminal commands via ClickFix social engineering. The resulting multi-stage infection chain strips quarantine attributes from the payload, showing strong operational overlaps with known Atomic Stealer delivery frameworks.
Commentary
This campaign highlights how threat actors continue to abuse trusted cloud platforms like Google Sites combined with search engine advertising to lower user skepticism. The reliance on manual Terminal execution emphasizes that technical controls alone cannot stop social engineering if users are coaxed into bypassing native OS protections. Organizations supporting developer environments should monitor for anomalous script execution originating from clipboard pastes and educate staff on the risks of ClickFix tactics.