Hackers Use Google Sites to Host Fake OpenAI Codex Download Pages

Key Takeaways

• Cybercriminals are leveraging Google Sites to host deceptive download pages for OpenAI Codex, primarily targeting macOS users.
• The attack employs a technique called “ClickFix,” where victims are prompted to manually execute a command in their Terminal, bypassing traditional download-based malware detection.
• The campaign utilizes paid search advertisements to funnel users to these malicious Google Sites pages, which impersonate legitimate software download portals.
• The threat shares infrastructure and delivery methods with the Atomic macOS Stealer (AMOS) malware, indicating a sophisticated and evolving threat landscape for macOS users.

Cybercriminals are exploiting Google Sites to establish convincing but fraudulent download pages for OpenAI Codex, transforming common online searches into sophisticated malware distribution channels. This campaign specifically targets macOS users, employing paid search placements to direct them towards these deceptive installer pages.

The malicious strategy extends beyond merely delivering a harmful application. Instead, it instructs visitors to copy a specific command, open their Terminal application, and execute the command themselves. This method, known as ClickFix, shifts the final stage of malware execution to the victim, effectively circumventing the suspicion typically associated with unexpected software downloads.

Analysts at Cato Networks uncovered this activity while monitoring sponsored search results for queries such as “codex macos download.” Cato said in a report that the observed attack chain exhibits significant similarities with the delivery mechanisms used by Atomic macOS Stealer (AMOS).

The danger extends beyond a single spoofed developer tool. By combining a paid advertisement, a legitimate Google-hosted platform, and a recognized software brand, the attackers construct a pathway that appears trustworthy at every initial interaction. Similar malicious Google Ads campaigns have previously demonstrated how paid search can expose macOS users to harmful software.

Hackers Abuse Google Sites

The sponsored search result prominently appeared above genuine search listings, directing unsuspecting users to a Google Sites page meticulously crafted to mimic an official Codex download portal. This page presented download options for both macOS and Linux; however, researchers confirmed that active malicious payloads were exclusively delivered to macOS users. Google Sites served as a trusted-looking facade, not the direct host of the primary malicious content.

The deceptive page loaded an attacker-controlled iframe, which allowed the operators to maintain a seemingly legitimate Google address while dynamically altering the displayed content. This architectural separation also complicates forensic analysis and takedown efforts.

One newer infrastructure setup incorporated an ingenious evasion tactic. Its live ClickFix content was hosted at the “/codexx/” path, while accessing the more obvious “/codex/” address would return a harmless product page. Furthermore, users attempting to access the page from a non-macOS device were also presented with benign content, frustrating automated scanners and security investigators. This campaign underscores why search results alone should not be considered definitive proof of authenticity.

ClickFix Chain Delivers macOS Payload

The fraudulent installer begins with a command that superficially resembles a legitimate Codex npm instruction. However, this command conceals a Base64-encoded address that retrieves a script and pipes it directly into zsh. While the victim perceives this as a standard setup step, executing the command initiates a sophisticated three-stage delivery chain. The initial script decodes an embedded component, which then generates a second script.

This second stage transmits an “event=pasted” signal, downloads the final Mach-O executable to “/tmp/helper,” removes its extended attributes using “xattr -c,” marks it as executable, and then launches it. The removal of extended attributes is a common technique used to diminish the security warnings typically associated with downloaded files.

Researchers identified significant overlap with AMOS delivery methods, including the use of encoded curl loaders, hidden zsh stages, telemetry transmission prior to payload retrieval, and the consistent use of the same temporary staging location. While this does not definitively prove that every final payload is identical, it provides valuable evidence for incident responders during threat hunting. Recent macOS ClickFix attack reports highlight the broader danger posed by prompts that encourage users to execute unfamiliar commands.

The attackers have demonstrated adaptability by reusing elements of their infrastructure while consistently rotating domains, payload locations, and even brand impersonations, including a related Claude Code-themed landing page. This flexibility emphasizes that indicators of compromise are most effective when combined with robust behavioral monitoring.

What You Should Do

• Always obtain developer tools and software directly from the official vendor’s website or trusted app stores.
• Carefully inspect the URL and domain of any download page before initiating a download or executing commands. Look for official branding and secure connections (HTTPS).
• Never copy and paste unfamiliar installation commands into your Terminal, especially if prompted by a website. Understand what a command does before running it.
• Treat sponsored search results with extreme caution, as they can be manipulated by malicious actors. Prioritize organic search results and official links.
• Security teams should monitor logs for suspicious shell commands, including Base64 decoding, ‘curl | zsh’ pipes, new executables in ‘/tmp/helper’, attribute removal (xattr -c), and unusual outbound network requests immediately following Terminal activity.
• Implement network controls to block known malicious lure domains, iframe hosts, telemetry servers, and payload delivery infrastructure.
• Develop detection rules that combine these behavioral indicators rather than relying solely on individual domain or file hashes, given the attackers’ infrastructure rotation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.