August 24, 2026 — Cato Networks' Cato CTRL team published a macOS campaign that starts where many developers actually start: Google search. Sponsored results for "codex macos download" sit above OpenAI's legitimate listing, route to Google Sites pages cloning the Codex download portal, and finish with ClickFix — a copied Terminal command that delivers a universal Mach-O payload Cato ties to Atomic macOS Stealer (AMOS) delivery patterns.
If you ship or support teams on Codex CLI, this is not generic macOS malware news. It is SEO-poisoned supply chain against the same install friction you ask juniors to overcome.
TL;DR — what people are asking
| Question | Answer |
|---|---|
| Who found it? | Cato CTRL — technical write-up Aug 24, 2026 |
| Entry vector? | Google Ads → Google Sites iframe → fake Codex portal |
| Payload path? | Terminal paste → Base64 URL → multi-stage zsh → Mach-O in /tmp/helper |
| Stealer family? | Strong AMOS delivery overlap (not sole IOC) |
| Linux affected? | Portal shows Linux button; Cato saw macOS delivery only |
| Prior art? | Claude Code ClickFix campaigns (Push Security, Cyderes) |
| Official install? | OpenAI docs only — never ad landing pages |
Attack chain (verified details)
Cato's blog post describes three infrastructure sets; one live path uses a Google Sites URL with an iframe from attacker-controlled hosts (e.g. bright-links.com patterns in their sample).
- Ad wins SERP — query intent is high: developer wants Codex on Mac now.
- Google Sites lends trust —
sites.google.comis not blocklisted like fresh domains. - Fake portal mirrors OpenAI — macOS/Linux buttons; only macOS path serves malware.
- ClickFix instruction — "Open Terminal, paste this install command."
- Command masquerades as npm — leading string looks like Codex install; tail decodes remote script.
- Telemetry fires early —
event=pastedstyle requests record successful social engineering. - Universal Mach-O — runs on Apple Silicon and Intel.
SC Media and SiliconANGLE confirmed the same timeline (Aug 24–25, 2026 reporting).
Why AI install lures keep working
Developers expect CLI installs for agent tools — Claude Code, OpenCode, Codex. A polished page saying "paste into Terminal" matches mental models built from legitimate docs.
Attackers rotate search keywords faster than security awareness slides update. May 2026 saw Claude Code install malvertising; August rotates to Codex macOS.
What this means for what you build or pay
Team onboarding: IT and platform eng should publish one canonical Codex install doc internally and block ad-click installs in security training — same playbook as npm supply chain hygiene.
Agent security reviews: If your harness docs link to "easy install" third-party mirrors, audit them. Indirect prompt injection is not the only social-engineering surface — install docs are.
MDM / EDR: Alert on Terminal execution following browser navigation to sites.google.com + outbound curl/bash to unknown domains on developer machines.
Safe Codex install checklist
- Navigate to OpenAI's official Codex documentation — type the URL or use a bookmark, not an ad click.
- Reject any page asking for a one-line Terminal paste without showing signed package artifacts.
- Compare with use Codex CLI setup guide steps your team already documents.
- Run Skillspector-style audits on internal install scripts so employees are not hunting random blogs.
Honest limitations
- Final binary naming — Cato emphasizes delivery-framework overlap; treat stealer attribution as operational consistency, not a single hash rule.
- Infrastructure rotation — operators swap iframe hosts; blocklists stale quickly.
- Linux path untested in Cato's sample — do not assume macOS-only forever.
- Google Ads abuse is platform-wide — reporting ads helps, but developers must treat sponsored AI-tool links as hostile by default.
Related on explainx.ai
- Use Codex CLI — computer and family IT setup
- MCP security guide 2026
- Four AI agent security incidents — pattern not coincidence
- DeepSeek hackers scale attacks with open agents
- Claude Code rm -rf Reddit incident — sandbox guide
- Destructive command guard for coding agents
- What is indirect prompt injection?
- Codex open-source models with Ollama
Campaign IOCs and infrastructure hosts evolve — verify against Cato CTRL's latest post and your EDR vendor before deploying detection rules. Details accurate as of August 26, 2026.