Threats · 49 days ago
Cato Networks said on August 24 that a fake OpenAI Codex download campaign used sponsored search results and Google Sites pages to push a macOS-only malware chain. The lure caught people searching for phrases like “codex macos download,” then led them to a Google Sites page that looked like a download portal.
The page did not hand over a normal file. It showed ClickFix-style instructions that told the user to open Terminal and paste a command; that command decoded a URL, fetched a shell-script loader, and ultimately retrieved the Mac payload. The Google Sites front end and iframe-delivered content made the hosting look familiar while the malicious action happened only after the paste.
That means web reputation alone can miss the real handoff from search result to shell execution. If users in your environment trust sponsored links and paste installer commands, the exposure sits across search, browser, and endpoint telemetry, not just on the hosting domain.
3 sources covering this story
Fake OpenAI Codex download tricks macOS users into installing malware - Help Net Security
Researchers found a fake Codex download page pushing Mac users to paste a malicious Terminal command, part of a wider ClickFix malware trend.
Crooks push Mac malware through fake OpenAI Codex ads
Sponsored search results lead developers straight into a ClickFix malware trap
Fake Codex Download Uses Google Sites to Deliver macOS Malware
Fake Codex pages used Google Sites, sponsored search and ClickFix to target Mac users
Part of the PlainSec briefing for 2026-08-26