A new malware campaign targets Mac developers by impersonating popular AI coding assistants, with fake Google ads guiding victims to download pages that deliver malicious payloads through a deceptive installation routine.

Researchers at Cato Networks discovered the operation after identifying sponsored search results for OpenAI's Codex that direct users to a convincing download page hosted on Google Sites. The page replicates OpenAI's branding but does not actually serve the Codex installer. Instead, it instructs Mac users to open Terminal and paste a command that initiates a multi-stage malware infection.

This approach is a variation of the 'ClickFix' technique, where attackers bypass traditional malicious executables by having victims execute commands themselves. In this case, the command includes a legitimate npm instruction for installing Codex but also appends Base64-encoded code that fetches a shell script from an attacker-controlled server and pipes it into zsh. That script downloads additional stages, including a Mach-O executable stored at '/tmp/helper', and removes macOS security attributes that would normally flag suspicious downloads.

The final malware payloads are universal Mach-O files, capable of running natively on both Intel-based Macs and Apple Silicon machines. Cato researchers noted substantial similarities between this campaign and Atomic macOS Stealer (AMOS), an infostealer previously distributed through fake software downloads and malicious ads. While Cato stops short of definitively identifying the malware as AMOS, it points to matching fingerprints in how the attack stages and final payload are built.

The attackers have implemented measures to avoid detection. Although victims initially land on Google Sites, the malicious content is loaded via an iframe from attacker-controlled infrastructure. That infrastructure checks the visitor's operating system and the URL path used to reach it, serving harmless content to anyone who doesn't match the intended profile. The decoy site displayed both macOS and Linux download buttons, but Cato only observed the malware chain delivering payloads to Mac users.

Codex is not the only AI assistant targeted. Cato found a similar ClickFix page posing as Anthropic's Claude Code, sharing infrastructure with the Codex campaign. Developers searching for these tools on Google are particularly vulnerable, as sponsored ads for the fake sites appear above legitimate search results.

Analysis

Why This Matters

• Mac developers, a traditionally less-targeted group, are being specifically exploited through trusted channels like Google Search and Google Sites, raising the risk of credential theft and source-code compromise.
• The 'ClickFix' technique shifts responsibility to the victim, making it harder for traditional antivirus and endpoint detection to catch the attack before execution.
• The use of AI coding assistant branding taps into a high-demand trend, increasing the likelihood that developers will trust the fake installer.

Background

Malware campaigns targeting developers have grown more sophisticated over the past year. The 'ClickFix' technique gained prominence in 2024, particularly against Windows users, but this campaign marks its expansion to macOS in a targeted, socially engineered form. AMOS, the suspected malware family here, first appeared in 2023 and has been linked to credential theft from cryptocurrency wallets and password managers. Previous versions were distributed through fake software updates and pirated apps, but this is among the first known cases using AI-tool branding via Google Ads. The use of Google Sites as a hosting layer adds legitimacy and makes takedown requests more complex, as malicious content is served from external iframes that bypass Google's review.

Key Perspectives

Cato Networks researchers: The campaign is highly targeted at developers and likely connected to existing AMOS infrastructure. The use of multiple AI branding (Codex and Claude Code) suggests a broader operation. They recommend users only download software from official sources and verify URLs carefully. Developers and security advocates: The attack underscores the danger of running pasted commands without verification, even from seemingly legitimate sites. Some argue that Google should more aggressively vet sponsored ads for software downloads, especially for high-risk categories like developer tools. Google (via its ad policies): Google's automated and manual review systems aim to catch malicious ads, but threat actors continuously adapt. Google may flag the fake sites after this report but faces an ongoing cat-and-mouse challenge. Critics and skeptics: The campaign's reliance on Google Sites and sponsored ads means it can be disrupted relatively quickly if reported. However, the attackers' use of iframe-based filtering and dynamic content makes detection harder for researchers and may allow the campaign to persist longer than expected.

What to Watch

• Number of reports from Mac developers about unexpected Terminal prompts or suspicious 'installation' instructions on Google Sites
• Google's response time in removing the fake ads and Sites pages
• Whether similar campaigns targeting other AI tools (e.g., GitHub Copilot, Tabnine) emerge, using the same infrastructure or technique