Crooks push Mac malware through fake OpenAI Codex ads
Cybercriminals are running a malvertising campaign that tricks Mac developers into installing malware disguised as OpenAI's Codex coding tool. Researchers at Cato Networks found sponsored Google search results directing users searching for Codex on macOS to a convincing fake download page hosted on Google Sites, which instead of providing an installer instructs victims to paste a Terminal command that triggers a multi-stage infection. This matters because it exploits developers' trust in AI coding assistants and search-ad rankings, potentially exposing sensitive credentials and systems to compromise.
The malicious command mimics a legitimate npm install instruction but secretly decodes a hidden URL, downloads a shell script and ultimately fetches a Mach-O executable capable of running on both Intel and Apple Silicon Macs, while stripping macOS security warnings to avoid detection. Cato found strong similarities to the known Atomic macOS Stealer (AMOS) malware, and the attackers used an iframe from separate infrastructure to serve harmless content to non-targeted visitors, evading researcher scrutiny. A similar fake page impersonating Anthropic's Claude Code was also found sharing the same infrastructure, suggesting the campaign targets multiple AI coding tools rather than just Codex.
- Fake Codex ads trick Mac users into running malware via Terminal
- Malware resembles AMOS infostealer, evades macOS security checks
- Similar fake Claude Code page found using shared attacker infrastructure
New here? Start with this
OpenAI Codex is a tool that helps people write computer code, and Mac developers may find it through an online search. Search engines can show paid adverts above ordinary results, so a convincing advert or download page can appear alongside genuine links.
Malware is harmful software that can steal information or give an intruder access to a device. Developers’ computers can hold valuable account details and access to workplace systems, so a fake coding tool can put more than one person’s data at risk.
The reported campaign also used a fake page for Anthropic’s Claude Code, another AI coding assistant. That suggests the approach may target people looking for several popular tools, rather than users of just one product.