Fake OpenAI Codex Download Pages on Google Sites Deliver ClickFix macOS Stealer Tied to Atomic Stealer (AMOS) Infrastructure

Fake OpenAI Codex Download Pages on Google Sites Deliver (TL-2026-2138), also tracked as Fake Codex ClickFix, is a high-severity malware campaign, first published 2026-08-25. It has no confirmed attribution, affects Apple macOS, maps to 11 MITRE ATT&CK techniques (T1027, T1036.005, T1059.004), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-2138

Threat ID
TL-2026-2138
Also known as
Fake Codex ClickFix, Codex ClickFix Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-25
Last reviewed
2026-08-25
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, software-development
Target regions
Global
Detection rules
9
Indicators of compromise
19

Malware and tooling in Fake OpenAI Codex Download Pages on Google Sites Deliver

Malware and tooling: AMOS, ClickFix

A malvertising campaign buys sponsored Google Ads for searches like "codex macos download" to route macOS users to fake OpenAI Codex install pages hosted on trusted Google Sites, then uses the ClickFix technique to trick victims into pasting a Base64-encoded Terminal command that runs a three-stage loader dropping a universal Mach-O payload at /tmp/helper. Cato Networks found the delivery framework across three infrastructure sets (plus a newer Claude Code-themed variant) shares encoded curl/zsh loaders, telemetry beacons, update-themed payload URLs, and quarantine-attribute stripping with Atomic macOS Stealer (AMOS), though final-payload attribution is delivery-similarity, not confirmed identity.

How Fake OpenAI Codex Download Pages on Google Sites Deliver works

Cato Networks documented a multi-stage macOS malware campaign that abuses paid Google Ads and Google Sites hosting to impersonate an OpenAI Codex download portal. Sponsored results for queries such as "codex macos download" are placed above the genuine OpenAI result and route visitors to a Google Sites page (sites.google.com/view/codex-desktop-app/) that loads attacker-controlled content via an embedded iframe, letting the operators keep the trusted google.com URL in the address bar while the actual lure content sits on separate, disposable infrastructure. The fake portal offers both macOS and Linux download buttons, but researchers observed active payload delivery only for macOS, and at least one infrastructure set gates content by path -- serving benign material at /codex/ while the live ClickFix flow is hidden at /codexx/ -- to frustrate automated scanning and takedown review.

Instead of a normal file download, the page instructs the victim to open Terminal and paste what looks like a routine npm setup command. In reality the pasted text is a Base64-encoded blob that decodes to a curl command piped into zsh, kicking off a three-stage delivery chain: a first-stage shell-script loader (increasingly obfuscated across infrastructure sets, with newer variants wrapping the payload in AES-encrypted gzip containers with scattered decryption-key variables instead of plain Base64), a second-stage script that calls home to a telemetry endpoint with an event=pasted parameter to confirm the victim executed the command before any payload is released, and a third stage that retrieves a universal Mach-O binary (built for both Intel and Apple Silicon) staged at /tmp/helper. Before execution, the loader strips the com.apple.quarantine extended attribute from the downloaded binary using xattr -c, removing the Gatekeeper warning a normal download would trigger, then makes the file executable and launches it.

Cato identified at least three distinct infrastructure sets sharing this framework -- one fronted by bright-links[.]com (iframe) with payloads served from trekmesh15[.]com and telemetry to grove-12[.]com; a second fronted by swiftsaverfin[.]com (iframe, with the hidden /codexx/ path) using aspencore18[.]com for payloads and atlas-compass[.]com for telemetry; and a third using quill-flint[.]com for payloads and grove-satin[.]com for telemetry, reusing the first set's iframe host -- plus a newer, separately themed variant impersonating Claude Code rather than Codex, fronted by parentpreneurx[.]com with payloads staged on vine-96[.]com. Researchers noted the same underlying ClickFix mechanics have also been used with a Node.js-themed installer lure, indicating the operators rotate developer-tool branding across campaigns while reusing the delivery framework.

Cato assessed the delivery framework shows "strong and consistent" overlap with previously documented Atomic macOS Stealer (AMOS) infection chains: Base64/AES-encoded curl-to-zsh loaders, telemetry-before-payload gating, update-themed payload URL paths, the /tmp/helper staging location, and quarantine-attribute stripping via xattr are all AMOS delivery hallmarks. Cato was explicit that this indicates delivery-framework similarity rather than confirmed identity of the final payload with AMOS proper. AMOS itself is a long-running macOS-focused stealer sold as malware-as-a-service on Telegram/hacking forums (originally observed 2023) whose typical capabilities include harvesting Keychain passwords, browser-stored credentials and cookies, and cryptocurrency wallet data; Sophos telemetry attributes roughly 40% of its 2025 macOS malware protection events to the AMOS family. No CVE applies -- this is a pure social-engineering and trusted-platform-abuse delivery chain rather than a software vulnerability, and detection requires correlating sponsored-search delivery, embedded web content, Terminal execution, and outbound network activity, since Cato noted no single stage reliably exposes the attack on its own.

MITRE ATT&CK techniques used in TL-2026-2138

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.001 User Execution: Malicious Link

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

defense-impairment

T1553.001 Subvert Trust Controls: Gatekeeper Bypass

Initial Access

T1566.002 Phishing: Spearphishing Link

Resource Development

T1583.006 Acquire Infrastructure: Web Services; T1583.008 Acquire Infrastructure: Malvertising; T1608.001 Stage Capabilities: Upload Malware

Affected products and versions in Fake OpenAI Codex Download Pages on Google Sites Deliver

  • Apple — macOS
    Vulnerable versions: any macOS version where a user manually strips the com.apple.quarantine attribute and executes an unsigned downloaded binary

Remediation for Fake OpenAI Codex Download Pages on Google Sites Deliver

Immediate actions

  • Block/sinkhole network egress to the identified C2 and telemetry domains (trekmesh15.com, grove-12.com, bright-links.com, swiftsaverfin.com, aspencore18.com, atlas-compass.com, quill-flint.com, grove-satin.com, parentpreneurx.com, vine-96.com) at DNS, proxy, and perimeter firewall
  • Hunt EDR telemetry for zsh/bash child processes of Terminal.app containing Base64-decoded curl commands piped into a shell
  • Search endpoints for Mach-O executables staged at /tmp/helper or any recently created file with a stripped com.apple.quarantine extended attribute
  • Isolate and forensically image any host where a user reports pasting a Terminal command from a software 'installer' or 'setup' web page

Workarounds

  • Restrict Terminal.app / shell execution via MDM for non-engineering user populations
  • Require developer-tool installers to be sourced only from an internal, vetted software catalog rather than search-ad links

Longer-term hardening

  • Deploy endpoint controls that alert on xattr -c / xattr -d com.apple.quarantine invocations against newly downloaded files
  • Enforce Gatekeeper via MDM configuration profiles and block execution of unsigned/unnotarized binaries fleet-wide
  • Run user-awareness training on the ClickFix pattern specifically: no legitimate installer ever requires pasting a command into Terminal
  • Monitor paid-search ad placements for brand impersonation of developer tools used internally (OpenAI Codex, Claude Code, Node.js, etc.) and file abuse/takedown reports against the identified domains and any newly registered look-alikes

Timeline of Fake OpenAI Codex Download Pages on Google Sites Deliver

  • Microsoft publishes a blog post on a related but distinct macOS ClickFix campaign using browser-fingerprinting gates to serve malicious content only to likely targets, establishing the broader technique trend this campaign extends.
  • The Hacker News reports a separate macOS ClickFix campaign delivering a Go-based stealer with a cryptocurrency-wallet-draining routine, showing the wider ClickFix-for-macOS trend AMOS-aligned actors are riding.
  • SiliconANGLE reports on Cato Networks' findings, including the path-based /codex/ vs /codexx/ evasion gating.
  • Cato Networks identifies a newer Claude Code-themed lure variant (parentpreneurx.com / vine-96.com) sharing the same delivery framework as the Codex-themed infrastructure.
  • Cato Networks publishes technical analysis of the Fake Codex ClickFix campaign, identifying three infrastructure sets, the three-stage delivery chain, and AMOS delivery-framework overlap.
  • Infosecurity Magazine publishes coverage summarizing Cato Networks' findings and detection-correlation guidance.
  • GBHackers publishes coverage disclosing the SHA256 hash of the first-stage shell-script loader and the grove-12.com telemetry endpoint path.
  • Cyber Security News publishes coverage of the campaign (source article for this threat record).

Sources cited for Fake OpenAI Codex Download Pages on Google Sites Deliver

Threats related to Fake OpenAI Codex Download Pages on Google Sites Deliver

Detection coverage for TL-2026-2138

As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2138 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2138

5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats