# Fake OpenAI Codex Download Pages on Google Sites Deliver ClickFix macOS Stealer Tied to Atomic Stealer (AMOS) Infrastructure

> A malvertising campaign buys sponsored Google Ads for searches like "codex macos download" to route macOS users to fake OpenAI Codex install pages hosted on trusted Google Sites, then uses the ClickFix technique to trick victims into pasting a Base64-encoded Terminal command that runs a three-stage loader dropping a universal Mach-O payload at /tmp/helper. Cato Networks found the delivery framework across three infrastructure sets (plus a newer Claude Code-themed variant) shares encoded curl/zsh loaders, telemetry beacons, update-themed payload URLs, and quarantine-attribute stripping with Atomic macOS Stealer (AMOS), though final-payload attribution is delivery-similarity, not confirmed identity.

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-08-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2138
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-fake-codex-clickfix-atomic-stealer-tl-2026-2138.webp?v=061269c1 (Threadlinqs threat intel: Atomic Stealer-Like Fake Codex ClickFix: Detection & IOCs (TL-2026-2138) — High severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-2138
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

Cato Networks documented a multi-stage macOS malware campaign that abuses paid Google Ads and Google Sites hosting to impersonate an OpenAI Codex download portal. Sponsored results for queries such as "codex macos download" are placed above the genuine OpenAI result and route visitors to a Google Sites page (sites.google.com/view/codex-desktop-app/) that loads attacker-controlled content via an embedded iframe, letting the operators keep the trusted google.com URL in the address bar while the actual lure content sits on separate, disposable infrastructure. The fake portal offers both macOS and Linux download buttons, but researchers observed active payload delivery only for macOS, and at least one infrastructure set gates content by path -- serving benign material at /codex/ while the live ClickFix flow is hidden at /codexx/ -- to frustrate automated scanning and takedown review.

Instead of a normal file download, the page instructs the victim to open Terminal and paste what looks like a routine npm setup command. In reality the pasted text is a Base64-encoded blob that decodes to a curl command piped into zsh, kicking off a three-stage delivery chain: a first-stage shell-script loader (increasingly obfuscated across infrastructure sets, with newer variants wrapping the payload in AES-encrypted gzip containers with scattered decryption-key variables instead of plain Base64), a second-stage script that calls home to a telemetry endpoint with an event=pasted parameter to confirm the victim executed the command before any payload is released, and a third stage that retrieves a universal Mach-O binary (built for both Intel and Apple Silicon) staged at /tmp/helper. Before execution, the loader strips the com.apple.quarantine extended attribute from the downloaded binary using xattr -c, removing the Gatekeeper warning a normal download would trigger, then makes the file executable and launches it.

Cato identified at least three distinct infrastructure sets sharing this framework -- one fronted by bright-links[.]com (iframe) with payloads served from trekmesh15[.]com and telemetry to grove-12[.]com; a second fronted by swiftsaverfin[.]com (iframe, with the hidden /codexx/ path) using aspencore18[.]com for payloads and atlas-compass[.]com for telemetry; and a third using quill-flint[.]com for payloads and grove-satin[.]com for telemetry, reusing the first set's iframe host -- plus a newer, separately themed variant impersonating Claude Code rather than Codex, fronted by parentpreneurx[.]com with payloads staged on vine-96[.]com. Researchers noted the same underlying ClickFix mechanics have also been used with a Node.js-themed installer lure, indicating the operators rotate developer-tool branding across campaigns while reusing the delivery framework.

Cato assessed the delivery framework shows "strong and consistent" overlap with previously documented Atomic macOS Stealer (AMOS) infection chains: Base64/AES-encoded curl-to-zsh loaders, telemetry-before-payload gating, update-themed payload URL paths, the /tmp/helper staging location, and quarantine-attribute stripping via xattr are all AMOS delivery hallmarks. Cato was explicit that this indicates delivery-framework similarity rather than confirmed identity of the final payload with AMOS proper. AMOS itself is a long-running macOS-focused stealer sold as malware-as-a-service on Telegram/hacking forums (originally observed 2023) whose typical capabilities include harvesting Keychain passwords, browser-stored credentials and cookies, and cryptocurrency wallet data; Sophos telemetry attributes roughly 40% of its 2025 macOS malware protection events to the AMOS family. No CVE applies -- this is a pure social-engineering and trusted-platform-abuse delivery chain rather than a software vulnerability, and detection requires correlating sponsored-search delivery, embedded web content, Terminal execution, and outbound network activity, since Cato noted no single stage reliably exposes the attack on its own.

## MITRE ATT&CK

- T1583.006 Acquire Infrastructure: Web Services
- T1583.008 Acquire Infrastructure: Malvertising
- T1608.001 Stage Capabilities: Upload Malware
- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1553.001 Subvert Trust Controls: Gatekeeper Bypass
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fake Codex ClickFix — Base64 curl-to-zsh Paste-and-Run via Terminal** (`TL-2026-2138-SPL-001`)

Detects Terminal.app spawning a shell (zsh/sh/bash) that runs a command line combining a base64-decode with a curl download piped directly into the interpreter — the ClickFix paste-and-run pattern used by the Fake Codex / Claude Code AMOS-aligned malvertising campaign to trigger the first-stage loader.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.001, T1566.002, T1059.004, T1027, T1140
- **Data sources:** crowdstrike_falcon_macos_sensor, jamf_protect_telemetry, osquery_process_events, macos_unified_logging
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=macos_endpoint (sourcetype="crowdstrike:events:sensor" event_simpleName=ProcessRollup2) OR sourcetype="jamf_protect:telemetry"
| eval parent=lower(coalesce(ParentBaseFileName, parent_process_name)), child=lower(coalesce(FileName, process_name)), cmdline=coalesce(CommandLine, process_args)
| where parent="terminal" AND child IN ("zsh","sh","bash")
| where match(cmdline, "(?i)base64\s+(-d|--decode)") AND match(cmdline, "(?i)curl\s") AND match(cmdline, "(?i)\|\s*(zsh|sh|bash)\s*$")
| eval mitre_technique="T1204.001,T1566.002,T1059.004,T1027,T1140"
| table _time, ComputerName, UserName, parent, child, cmdline, mitre_technique
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "Terminal"
| where FileName in~ ("zsh", "sh", "bash")
| where ProcessCommandLine has "base64" and ProcessCommandLine matches regex @"(?i)-(d|-decode)"
| where ProcessCommandLine has "curl" and ProcessCommandLine matches regex @"\|\s*(zsh|sh|bash)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, ReportId
| order by Timestamp desc
```

### Sigma

```yaml
title: macOS ClickFix Base64 curl-to-zsh Paste-and-Run via Terminal
id: 7f3a1c2e-4b5d-4e6f-9a1b-2c3d4e5f6071
status: experimental
description: Detects a Terminal-spawned shell (zsh/sh/bash) executing a command line that base64-decodes a payload and pipes a curl download directly into an interpreter — the ClickFix paste-and-run pattern used by the Fake Codex/Claude Code AMOS-aligned campaign.
references:
  - https://cybersecuritynews.com/hackers-abuse-google-sites/
  - https://gbhackers.com/fake-codex-download/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-25
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.t1059.004
  - attack.defense-evasion
  - attack.t1027
  - attack.t1140
  - attack.tool.clickfix
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith: '/Terminal'
  selection_child:
    Image|endswith:
      - '/zsh'
      - '/sh'
      - '/bash'
  selection_cmd:
    CommandLine|contains: 'base64'
  selection_decode:
    CommandLine|re: '(?i)-(d|-decode)'
  selection_pipe:
    CommandLine|contains: 'curl'
  condition: all of selection_*
falsepositives:
  - Developers or admins legitimately base64-decoding and piping content into a shell for benign automation
level: high
```

**Known false positives:**

- Legitimate developer/admin workflows that base64-decode payloads and pipe them into a shell for automation or CI tooling
- IT-provisioned curl-to-shell installer scripts from trusted internal package managers (e.g. Homebrew) may superficially match; verify parent process and destination domain

**Tuning notes:** Suppress where the download domain resolves to a corporate-approved software distribution allowlist (Homebrew, internal MDM package servers); correlate with the browser process that spawned Terminal (or a preceding visit to sites.google.com/view/codex-desktop-app/) for high-confidence escalation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake Codex ClickFix — Base64 curl-to-zsh Paste-and-Run via Terminal (locked: unlock with TL Creds)
- AMOS-Aligned Quarantine Bypass and [indicator] Mach-O Payload Execution (locked: unlock with TL Creds)
- Beacon to Fake Codex ClickFix / AMOS C2 and Telemetry Infrastructure (locked: unlock with TL Creds)
- Fake Codex ClickFix — Base64 curl-to-zsh Paste-and-Run via Terminal (locked: unlock with TL Creds)
- AMOS-Aligned Quarantine Bypass and [indicator] Mach-O Payload Execution (locked: unlock with TL Creds)
- Beacon to Fake Codex ClickFix / AMOS C2 and Telemetry Infrastructure (locked: unlock with TL Creds)
- AMOS-Aligned Quarantine Bypass and [indicator] Mach-O Payload Execution (locked: unlock with TL Creds)
- Beacon to Fake Codex ClickFix / AMOS C2 and Telemetry Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `trekmesh15[.]com`
- URL: `hxxps://sites[.]google[.]com/view/codex-desktop-app/`
- File hash: `ad4e26afb47dc6262d43b5616853349c3bbdab5c8eedac80f695151e00c07df8`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Abuse Google Sites to Host Fake OpenAI Codex Download Pages](https://cybersecuritynews.com/hackers-abuse-google-sites/)
- [Hackers Place Fake Codex Download Above Legitimate OpenAI Result to Infect Mac Users](https://gbhackers.com/fake-codex-download/)
- [Fake Codex Download Uses Google Sites to Deliver macOS Malware](https://www.infosecurity-magazine.com/news/fake-codex-download-google-sites/)
- [Fake Codex installer tricks Mac users into pasting malware, Cato finds](https://siliconangle.com/2026/08/24/fake-codex-installer-tricks-mac-users-into-pasting-malware-cato-finds/)
- [ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets](https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2138