Particle.news
Get it on Google Play
Download on the App Store
3 ARTICLES
·
4h ago

Fake OpenAI Codex Ads Lure Mac Users to Terminal-Based Malware

Researchers say the campaign exploited Google Ads and trusted hosting to remove macOS security flags and hide malicious code from analysts.

Cybersecurity ensures data protection on internet. Data encryption, firewall, encrypted network, VPN, secure access and authentication defend against malware, hacking, cyber crime and digital threat
Image

Overview

  • Cato Networks researchers reported on August 24–25 that sponsored searches for “codex macos download” sent users to Google Sites pages that embedded attacker-controlled iframes and instructed macOS users to paste a Terminal command.
  • The pasted command decoded a Base64 URL, fetched a shell-script loader that ran a second-stage script, and ultimately staged a universal Mach-O binary in /tmp/helper.
  • The second-stage script used xattr -c to strip extended attributes and remove macOS quarantine metadata so the payload could run without standard download warnings.
  • Researchers found strong delivery-framework overlap with the Atomic macOS Stealer (AMOS) chain but warned that the similarity in tooling does not prove the final payload is AMOS.
  • Defenders are urged to correlate sponsored-search referrals, embedded iframe activity, Terminal command execution, and outbound network indicators while users should never paste Terminal commands from untrusted search results.