Fake OpenAI Codex Download Pages on Google Sites Deliver ClickFix macOS Stealer Tied to Atomic Stealer (AMOS) Infrastructure — Threadlinqs Intelligence
As of 2026-08-25, Fake OpenAI Codex Download Pages on Google Sites Deliver ClickFix macOS Stealer Tied to Atomic Stealer (AMOS) Infrastructure is a high-severity malware threat attributed to Unidentified operator using Atomic macOS Stealer -aligned delivery infrastructure, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-2138 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Unidentified operator using Atomic macOS Stealer -aligned delivery infrastructure · FINANCIAL
A malvertising campaign buys sponsored Google Ads for searches like "codex macos download" to route macOS users to fake OpenAI Codex install pages hosted on trusted Google Sites, then uses the
Cato Networks documented a multi-stage macOS malware campaign that abuses paid Google Ads and Google Sites hosting to impersonate an OpenAI Codex download portal. Sponsored results for queries such as "codex macos download" are placed above the genuine OpenAI result and route visitors to a Google Sites page (sites.google.com/view/codex-desktop-app/) that loads attacker-controlled content via an embedded iframe, letting the operators keep the trusted google.com URL in the address bar while the actual lure content sits on separate, disposable infrastructure. The fake portal offers both macOS and Linux download buttons, but researchers observed active payload delivery only for macOS, and at least one infrastructure set gates content by path -- serving benign material at /codex/ while the live ClickFix flow is hidden at /codexx/ -- to frustrate automated scanning and takedown review.
Instead of a normal file download, the page instructs the victim to open Terminal and paste what looks like a routine npm setup command. In reality the pasted text is a Base64-encoded blob that decodes to a curl command piped into zsh, kicking off a three-stage delivery chain: a first-stage shell-script loader (increasingly obfuscated across infrastructure sets, with newer variants wrapping the payload in AES-encrypted gzip containers with scattered decryption-key variables instead of plain Base64), a second-stage script that calls home to a telemetry endpoint with an event=pasted parameter to confirm the victim executed the command before any payload is released, and a third stage that retrieves a universal Mach-O binary (built for both Intel and Apple Silicon) staged at /tmp/helper. Before execution, the loader strips the com.apple.quarantine extended attribute from the downloaded binary using xattr -c, removing the Gatekeeper warning a normal download would trigger, then makes the file executable and launches it.
Cato identified at least three distinct infrastructure sets sharing this framework -- one fronted by bright-links[.]com (iframe) with payloads served from trekmesh15[.]com and telemetry to grove-12[.]com; a second fronted by swiftsaverfin[.]com (iframe, with the hidden /codexx/ path) using aspencore18[.]com for payloads and atlas-compass[.]com for telemetry; and a third using quill-flint[.]com for payloads and grove-satin[.]com for telemetry, reusing the first set's iframe host -- plus a newer, separately themed variant impersonating Claude Code rather than Codex, fronted by parentpreneurx[.]com with payloads staged on vine-96[.]com. Researchers noted the same underlying ClickFix mechanics have also been used with a Node.js-themed installer lure, indicating the operators rotate developer-tool branding across campaigns while reusing the delivery framework.
Cato assessed the delivery framework shows "strong and consistent" overlap with previously documented Atomic macOS Stealer (AMOS) infection chains: Base64/AES-encoded curl-to-zsh loaders, telemetry-before-payload gating, update-themed payload URL paths, the /tmp/helper staging location, and quarantine-attribute stripping via xattr are all AMOS delivery hallmarks. Cato was explicit that this indicates delivery-framework similarity rather than confirmed identity of the final payload with AMOS proper. AMOS itself is a long-running macOS-focused stealer sold as malware-as-a-service on Telegram/hacking forums (originally observed 2023) whose typical capabilities include harvesting Keychain passwords, browser-stored credentials and cookies, and cryptocurrency wallet data; Sophos telemetry attributes roughly 40% of its 2025 macOS malware protection events to the AMOS family. No CVE applies -- this is a pure social-engineering and trusted-platform-abuse delivery chain rather than a software vulnerability, and detection requires correlating sponsored-search delivery, embedded web content, Terminal execution, and outbound network activity, since Cato noted no single stage reliably exposes the at
Target sectors: technology, software-development
Target regions: Global
Timeline
- Microsoft publishes a blog post on a related but distinct macOS ClickFix campaign using browser-fingerprinting gates to serve malicious content only to likely targets, establishing the broader technique trend this campaign extends.
- The Hacker News reports a separate macOS ClickFix campaign delivering a Go-based stealer with a cryptocurrency-wallet-draining routine, showing the wider ClickFix-for-macOS trend AMOS-aligned actors are riding.
- Cato Networks publishes technical analysis of the Fake Codex ClickFix campaign, identifying three infrastructure sets, the three-stage delivery chain, and AMOS delivery-framework overlap.
- Cato Networks identifies a newer Claude Code-themed lure variant (parentpreneurx.com / vine-96.com) sharing the same delivery framework as the Codex-themed infrastructure.
- SiliconANGLE reports on Cato Networks' findings, including the path-based /codex/ vs /codexx/ evasion gating.
- Cyber Security News publishes coverage of the campaign (source article for this threat record).
- GBHackers publishes coverage disclosing the SHA256 hash of the first-stage shell-script loader and the grove-12.com telemetry endpoint path.
- Infosecurity Magazine publishes coverage summarizing Cato Networks' findings and detection-correlation guidance.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583.006, T1583.008, T1608.001, T1566.002, T1204.001, T1059.004, T1036.005, T1140, T1027, T1553.001
