Attackers are using fake OpenAI Codex download pages to target Mac developers through sponsored Google search results, according to The Register, citing research from Cato Networks. The campaign steers people searching for Codex on macOS to a convincing-looking page hosted on Google Sites and styled with OpenAI branding, but the site does not deliver a legitimate installer. Instead, The Register reports, the page tells Mac users to open Terminal, paste a supplied command, and run it as if that were part of installation. Cato describes the technique as a variant of “ClickFix,” a social-engineering pattern in which victims are persuaded to execute the attacker’s command themselves rather than open a conventional malicious attachment or installer. The command begins with what appears to be an npm instruction for installing Codex, according to the report. Attached to it is code that decodes a Base64-encoded URL, retrieves a shell script from attacker-controlled infrastructure, and pipes that script into zsh. Cato’s analysis, as summarized by The Register, says the shell script then pulls down a later stage and contacts the attacker’s server to indicate that a victim has engaged with the lure. The chain ultimately downloads a Mach-O executable to “/tmp/helper,” removes macOS security information used to flag suspicious downloads, and launches the malware. Cato said the final binaries are universal Mach-O files, meaning they can run natively on both Intel-based Macs and Apple Silicon machines. The researchers found substantial similarities between the campaign and Atomic macOS Stealer, also known as AMOS, an infostealer that has previously been spread through fake software downloads and malicious advertising. Cato did not definitively label the malware as AMOS, according to The Register, but said the staging and final payload construction show multiple overlapping fingerprints. The campaign also includes measures aimed at limiting researcher visibility. Although victims first land on Google Sites, The Register says the malicious content is pulled into the page through an iframe from attacker-controlled infrastructure. That infrastructure checks details such as the visitor’s operating system and the path used to reach the page, which lets the site show benign-looking content to visitors outside the attackers’ intended profile. Cato said the decoy site displayed both macOS and Linux download buttons, but it only observed the malware chain being delivered to Mac users. The Register also reports that Cato found a similar ClickFix page posing as Anthropic’s Claude Code and sharing infrastructure with the Codex campaign. The immediate takeaway for engineering teams is narrow but important: attackers are now wrapping developer-tool lures around AI coding assistants, then using paid search placement and command-line instructions to make the compromise look like normal setup work. Who benefits: Attackers benefit from demand around AI coding tools and from sponsored search placement that can put a fake download page in front of high-intent developers. The technique also benefits from the familiarity of command-line installation flows. Who's exposed: Mac developers searching for OpenAI Codex or similar AI coding assistants are the exposed group identified in the report. Cato observed delivery to Mac users, while the decoy page also showed a Linux download option.