A recent investigation by Cato Networks has unveiled a sophisticated fraudulent campaign masquerading as a Codex download for macOS and Linux users. The campaign has employed various deceptive strategies, including sponsored search results and authentic Google Sites pages, to mislead unsuspecting users into downloading malware.
In a detailed technical write-up released on August 24, researchers from Cato Networks outlined how this malicious campaign targets users searching for “Codex macOS download.” By leveraging sponsored search results, the attackers redirect victims to Google Sites pages that falsely claim to be an official OpenAI Codex download portal. Although the fake site purportedly offered download options for both macOS and Linux, the researchers noted that actual malware delivery was predominantly aimed at macOS users.
### The Role of Google Sites in Establishing Credibility
The use of Google Sites significantly enhances the credibility of the malicious campaign. Beneath the surface of seemingly legitimate Google Sites pages lies a complex web of attacker-controlled content delivered through iframes. This ingenious tactic allows the operatives to exploit a trusted domain for the initial engagement while hosting the active ClickFix content on a different infrastructure. Cato Networks identified a total of three distinct infrastructure sets used in the execution of this campaign. The third of these frameworks notably reused an iframe host seen in the first framework.
To further complicate detection, a secondary infrastructure introduced a clever evasion technique. The malicious ClickFix page was served from an unexpected URL pathway, while a more intuitive URL led to a benign fake product page. This meticulous orchestration raises significant concerns about the potential for automated analysis tools or cybersecurity researchers to encounter a harmless page instead of the actual malicious content, especially if accessed from non-macOS devices. This element of path and operating system awareness empowers the attackers to conceal their activities more effectively.
### Execution of the Malware
Once the unwitting victim interacts with the fake installer, they are instructed to open the Terminal application and paste a command that appears to be a legitimate installation process for Codex. However, behind this façade, the command performs various nefarious actions that culminate in a malware payload delivery. Specifically, the command decodes an encoded URL, leading to the retrieval of a shell script designed to initiate a multi-stage infection chain.
Cato Networks detailed that the infection process unfolds in three distinct stages, culminating in the deployment of a Mach-O payload. The initial launch command effects a shell-script loader, responsible for decoding and executing a secondary script, which then retrieves the final Mach-O payload. As the researchers dug deeper, they observed that the loader became increasingly encrypted and obfuscated across different infrastructure sets. Additionally, the second script documented the act of pasting the command before proceeding to procure the final payload.
Prior to activating the final payload, the second stage deposits it in the temporary directory (/tmp/helper), cleverly stripping the file of extended attributes. This maneuver effectively removes the download-related quarantine metadata, which typically prompts macOS warnings about files sourced from the internet. This step enhances the likelihood that users will unknowingly execute the infected file without raising suspicions.
### Overlap with AMOS Delivery Framework
Cato Networks also highlighted alarming similarities between this fraudulent campaign’s delivery framework and a previously documented infection chain associated with the Atomic macOS Stealer (AMOS). Key parallels include the usage of encoded shell loaders, telemetry requests, and payload retrieval themes, particularly crafted to function on both Intel and Apple Silicon Macs while being staged in the same temporary directory. However, the researchers emphasized that, despite these similarities, they do not equate the final payload with AMOS directly. The telemetry observed should not be interpreted as proof of how the Mach-O payload behaves once executed.
These findings illuminate a broader trend of attackers leveraging AI-tool impersonation and ClickFix campaigns to target users. By utilizing trusted platforms and familiar developer workflows, these malicious actors can increase their chances of success.
For those dedicated to cybersecurity, Cato Networks emphasized that effective detection of the ongoing campaign necessitates a multi-faceted approach. This involves correlating elements such as sponsored-search delivery, embedded web content, Terminal execution, and outbound activity rather than depending on any single indicator. Such comprehensive monitoring can enhance defenses against these increasingly sophisticated cyber threats.