Fake OpenAI Codex Download Pages on Google Sites Deliver ClickFix macOS Stealer Tied to Atomic Stealer (AMOS) Infrastructure

Key facts for Fake Codex ClickFix Atomic Stealer

Detection coverage for Fake Codex ClickFix Atomic Stealer

As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2138 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fake Codex ClickFix — Base64 curl-to-zsh Paste-and-Run via Terminal

Detects Terminal.app spawning a shell (zsh/sh/bash) that runs a command line combining a base64-decode with a curl download piped directly into the interpreter — the ClickFix paste-and-run pattern used by the Fake Codex / Claude Code AMOS-aligned malvertising campaign to trigger the first-stage loader.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.001, T1566.002, T1059.004, T1027, T1140
• Data sources: crowdstrike_falcon_macos_sensor, jamf_protect_telemetry, osquery_process_events, macos_unified_logging
• Severity: high
• Confidence: high

Splunk SPL

index=macos_endpoint (sourcetype="crowdstrike:events:sensor" event_simpleName=ProcessRollup2) OR sourcetype="jamf_protect:telemetry"
| eval parent=lower(coalesce(ParentBaseFileName, parent_process_name)), child=lower(coalesce(FileName, process_name)), cmdline=coalesce(CommandLine, process_args)
| where parent="terminal" AND child IN ("zsh","sh","bash")
| where match(cmdline, "(?i)base64\s+(-d|--decode)") AND match(cmdline, "(?i)curl\s") AND match(cmdline, "(?i)\|\s*(zsh|sh|bash)\s*$")
| eval mitre_technique="T1204.001,T1566.002,T1059.004,T1027,T1140"
| table _time, ComputerName, UserName, parent, child, cmdline, mitre_technique
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "Terminal"
| where FileName in~ ("zsh", "sh", "bash")
| where ProcessCommandLine has "base64" and ProcessCommandLine matches regex @"(?i)-(d|-decode)"
| where ProcessCommandLine has "curl" and ProcessCommandLine matches regex @"\|\s*(zsh|sh|bash)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, ReportId
| order by Timestamp desc

Sigma

title: macOS ClickFix Base64 curl-to-zsh Paste-and-Run via Terminal
id: 7f3a1c2e-4b5d-4e6f-9a1b-2c3d4e5f6071
status: experimental
description: Detects a Terminal-spawned shell (zsh/sh/bash) executing a command line that base64-decodes a payload and pipes a curl download directly into an interpreter — the ClickFix paste-and-run pattern used by the Fake Codex/Claude Code AMOS-aligned campaign.
references:
  - https://cybersecuritynews.com/hackers-abuse-google-sites/
  - https://gbhackers.com/fake-codex-download/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-25
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.t1059.004
  - attack.defense-evasion
  - attack.t1027
  - attack.t1140
  - attack.tool.clickfix
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith: '/Terminal'
  selection_child:
    Image|endswith:
      - '/zsh'
      - '/sh'
      - '/bash'
  selection_cmd:
    CommandLine|contains: 'base64'
  selection_decode:
    CommandLine|re: '(?i)-(d|-decode)'
  selection_pipe:
    CommandLine|contains: 'curl'
  condition: all of selection_*
falsepositives:
  - Developers or admins legitimately base64-decoding and piping content into a shell for benign automation
level: high

Known false positives:

• Legitimate developer/admin workflows that base64-decode payloads and pipe them into a shell for automation or CI tooling
• IT-provisioned curl-to-shell installer scripts from trusted internal package managers (e.g. Homebrew) may superficially match; verify parent process and destination domain

Tuning notes: Suppress where the download domain resolves to a corporate-approved software distribution allowlist (Homebrew, internal MDM package servers); correlate with the browser process that spawned Terminal (or a preceding visit to sites.google.com/view/codex-desktop-app/) for high-confidence escalation.

• 🔒 Fake Codex ClickFix — Base64 curl-to-zsh Paste-and-Run via Terminal · unlock with TL Creds
• 🔒 AMOS-Aligned Quarantine Bypass and [indicator] Mach-O Payload Execution · unlock with TL Creds
• 🔒 Beacon to Fake Codex ClickFix / AMOS C2 and Telemetry Infrastructure · unlock with TL Creds
• 🔒 Fake Codex ClickFix — Base64 curl-to-zsh Paste-and-Run via Terminal · unlock with TL Creds
• 🔒 AMOS-Aligned Quarantine Bypass and [indicator] Mach-O Payload Execution · unlock with TL Creds
• 🔒 Beacon to Fake Codex ClickFix / AMOS C2 and Telemetry Infrastructure · unlock with TL Creds
• 🔒 AMOS-Aligned Quarantine Bypass and [indicator] Mach-O Payload Execution · unlock with TL Creds
• 🔒 Beacon to Fake Codex ClickFix / AMOS C2 and Telemetry Infrastructure · unlock with TL Creds

Indicators of compromise for Fake Codex ClickFix Atomic Stealer

As of 2026-08-25, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2138.

Sample indicators (3 of 19)

• Domain: trekmesh15[.]com
• URL: hxxps://sites[.]google[.]com/view/codex-desktop-app/
• File hash: ad4e26afb47dc6262d43b5616853349c3bbdab5c8eedac80f695151e00c07df8

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

Community OSINT corroboration for Fake Codex ClickFix Atomic Stealer

5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Fake Codex ClickFix Atomic Stealer works

Cato Networks found the delivery framework across three infrastructure sets (plus a newer Claude Code-themed variant) shares encoded curl/zsh loaders, telemetry beacons, update-themed payload URLs, and quarantine-attribute stripping with Atomic macOS Stealer (AMOS), though final-payload attribution is delivery-similarity, not confirmed identity.

Cato Networks documented a multi-stage macOS malware campaign that abuses paid Google Ads and Google Sites hosting to impersonate an OpenAI Codex download portal. Sponsored results for queries such as "codex macos download" are placed above the genuine OpenAI result and route visitors to a Google Sites page (sites.google.com/view/codex-desktop-app/) that loads attacker-controlled content via an embedded iframe, letting the operators keep the trusted google.com URL in the address bar while the actual lure content sits on separate, disposable infrastructure. The fake portal offers both macOS and Linux download buttons, but researchers observed active payload delivery only for macOS, and at least one infrastructure set gates content by path -- serving benign material at /codex/ while the live ClickFix flow is hidden at /codexx/ -- to frustrate automated scanning and takedown review.

Instead of a normal file download, the page instructs the victim to open Terminal and paste what looks like a routine npm setup command. In reality the pasted text is a Base64-encoded blob that decodes to a curl command piped into zsh, kicking off a three-stage delivery chain: a first-stage shell-script loader (increasingly obfuscated across infrastructure sets, with newer variants wrapping the payload in AES-encrypted gzip containers with scattered decryption-key variables instead of plain Base64), a second-stage script that calls home to a telemetry endpoint with an event=pasted parameter to confirm the victim executed the command before any payload is released, and a third stage that retrieves a universal Mach-O binary (built for both Intel and Apple Silicon) staged at /tmp/helper. Before execution, the loader strips the com.apple.quarantine extended attribute from the downloaded binary using xattr -c, removing the Gatekeeper warning a normal download would trigger, then makes the file executable and launches it.

Cato identified at least three distinct infrastructure sets sharing this framework -- one fronted by bright-links[.]com (iframe) with payloads served from trekmesh15[.]com and telemetry to grove-12[.]com; a second fronted by swiftsaverfin[.]com (iframe, with the hidden /codexx/ path) using aspencore18[.]com for payloads and atlas-compass[.]com for telemetry; and a third using quill-flint[.]com for payloads and grove-satin[.]com for telemetry, reusing the first set's iframe host -- plus a newer, separately themed variant impersonating Claude Code rather than Codex, fronted by parentpreneurx[.]com with payloads staged on vine-96[.]com. Researchers noted the same underlying ClickFix mechanics have also been used with a Node.js-themed installer lure, indicating the operators rotate developer-tool branding across campaigns while reusing the delivery framework.

Cato assessed the delivery framework shows "strong and consistent" overlap with previously documented Atomic macOS Stealer (AMOS) infection chains: Base64/AES-encoded curl-to-zsh loaders, telemetry-before-payload gating, update-themed payload URL paths, the /tmp/helper staging location, and quarantine-attribute stripping via xattr are all AMOS delivery hallmarks. Cato was explicit that this indicates delivery-framework similarity rather than confirmed identity of the final payload with AMOS proper. AMOS itself is a long-running macOS-focused stealer sold as malware-as-a-service on Telegram/hacking forums (originally observed 2023) whose typical capabilities include harvesting Keychain passwords, browser-stored credentials and cookies, and cryptocurrency wallet data; Sophos telemetry attributes roughly 40% of its 2025 macOS malware protection events to the AMOS family. No CVE applies -- this is a pure social-engineering and trusted-platform-abuse delivery chain rather than a software vulnerability, and detection requires correlating sponsored-search delivery, embedded web content, Terminal execution, and outbound network activity, since Cato noted no single stage reliably exposes the attack on its own.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.001 User Execution: Malicious Link

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

defense-impairment

T1553.001 Subvert Trust Controls: Gatekeeper Bypass

Initial Access

T1566.002 Phishing: Spearphishing Link

Resource Development

T1583.006 Acquire Infrastructure: Web Services; T1583.008 Acquire Infrastructure: Malvertising; T1608.001 Stage Capabilities: Upload Malware

Remediation for Fake Codex ClickFix Atomic Stealer

Immediate actions

• Block/sinkhole network egress to the identified C2 and telemetry domains (trekmesh15.com, grove-12.com, bright-links.com, swiftsaverfin.com, aspencore18.com, atlas-compass.com, quill-flint.com, grove-satin.com, parentpreneurx.com, vine-96.com) at DNS, proxy, and perimeter firewall
• Hunt EDR telemetry for zsh/bash child processes of Terminal.app containing Base64-decoded curl commands piped into a shell
• Search endpoints for Mach-O executables staged at /tmp/helper or any recently created file with a stripped com.apple.quarantine extended attribute
• Isolate and forensically image any host where a user reports pasting a Terminal command from a software 'installer' or 'setup' web page

Workarounds

• Restrict Terminal.app / shell execution via MDM for non-engineering user populations
• Require developer-tool installers to be sourced only from an internal, vetted software catalog rather than search-ad links

Longer-term hardening

• Deploy endpoint controls that alert on xattr -c / xattr -d com.apple.quarantine invocations against newly downloaded files
• Enforce Gatekeeper via MDM configuration profiles and block execution of unsigned/unnotarized binaries fleet-wide
• Run user-awareness training on the ClickFix pattern specifically: no legitimate installer ever requires pasting a command into Terminal
• Monitor paid-search ad placements for brand impersonation of developer tools used internally (OpenAI Codex, Claude Code, Node.js, etc.) and file abuse/takedown reports against the identified domains and any newly registered look-alikes

Affected and fixed versions

• Apple — macOS
  Vulnerable versions: any macOS version where a user manually strips the com.apple.quarantine attribute and executes an unsigned downloaded binary

Timeline of Fake Codex ClickFix Atomic Stealer

• 2026-05-06 Microsoft publishes a blog post on a related but distinct macOS locked-ioc-19 campaign using browser-fingerprinting gates to serve malicious content only to likely targets, establishing the broader technique trend this campaign extends.
• 2026-08-07 The Hacker News reports a separate macOS locked-ioc-19 campaign delivering a Go-based stealer with a cryptocurrency-wallet-draining routine, showing the wider ClickFix-for-macOS trend AMOS-aligned actors are riding.
• 2026-08-24 SiliconANGLE reports on Cato Networks' findings, including the path-based /codex/ vs /codexx/ evasion gating.
• 2026-08-24 Cato Networks identifies a newer Claude Code-themed lure variant (locked-ioc-7 / locked-ioc-17) sharing the same delivery framework as the Codex-themed infrastructure.
• 2026-08-24 Cato Networks publishes technical analysis of the Fake Codex locked-ioc-19 campaign, identifying three infrastructure sets, the three-stage delivery chain, and AMOS delivery-framework overlap.
• 2026-08-25 Infosecurity Magazine publishes coverage summarizing Cato Networks' findings and detection-correlation guidance.
• 2026-08-25 GBHackers publishes coverage disclosing the SHA256 hash of the first-stage shell-script loader and the locked-ioc-15 telemetry endpoint path.
• 2026-08-25 Cyber Security News publishes coverage of the campaign (source article for this threat record).

Sources cited for Fake Codex ClickFix Atomic Stealer

• ClickFix campaign uses fake macOS utilities lures to deliver infostealers Microsoft · Vendor report · 2026-05-06
• Hackers Abuse Google Sites to Host Fake OpenAI Codex Download Pages cybersecuritynews.com · News · 2026-08-25
• Hackers Place Fake Codex Download Above Legitimate OpenAI Result to Infect Mac Users gbhackers.com · News · 2026-08-25
• Fake Codex Download Uses Google Sites to Deliver macOS Malware infosecurity-magazine.com · News · 2026-08-25
• Fake Codex installer tricks Mac users into pasting malware, Cato finds siliconangle.com · News · 2026-08-24
• ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets The Hacker News · News · 2026-08-07

Threats related to Fake Codex ClickFix Atomic Stealer

• Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
• Expired-Domain Resale Abuse Fuels Malware Delivery: Sable Squirrel and Scavenger Threat Clusters (Quasar RAT, AsyncRAT, DCRat, Remcos RAT, SocGholish)
• Pre-Release Domain Abuse Campaign Targets GTA 6 (Grand Theft Auto VI) — 922 Malicious Domains Across Typosquatting, Purchase Fraud, Crypto Lures, and Malware Distribution
• JoseCmanXD Rust Crypto Clipboard Hijacker ("silke"/"silkebin") Distributed via Fake Reputation Across GitHub, SourceForge, YouTube and VirusTotal
• Infostealer Malware Hijacks Claude Login Sessions to Bypass MFA and Drain Usage; Related FakeAgent Malvertising Campaign Deploys SectopRAT via Trojanized Claude Desktop Installer

Related coverage of this activity

• Go macOS Keychain wallet drainer
• Atomic Stealer ClickFix fingerprint gate
• ASTERIX LLM crypto fraud
• MacSync via verified X ads
• Atomic Stealer fake toolkit lure

Previous and next in malware

• First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnet Previous report
• ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealer Next report

Further reading

• Matryoshka ClickFix: macOS AppleScript Stealer