Fake OpenAI Codex Download Lures macOS Users into Executing Malware via Terminal
What Happened – A threat‑actor runs a sponsored search ad that mimics an OpenAI Codex download page hosted on Google Sites. The page convinces macOS users to copy‑paste a malicious command into Terminal, which decodes a Base64 URL, pulls a script, and ultimately installs a universal Mach‑O binary. The delivery chain mirrors the Atomic macOS Stealer (AMOS) family.
Why It Matters for Compliance & Audit Readiness
- The attack exploits a classic “click‑to‑run” social‑engineering vector that SOC 2 access‑control policies are designed to prevent and evidence.
- Continuous monitoring of command‑execution controls and documented security‑awareness training provide audit‑ready proof that your organization mitigates user‑initiated malware.
Who Is Affected – Primarily developers and power‑users of macOS across technology‑SaaS, cloud‑infra, and any organization that permits terminal access on employee devices.
Recommended Actions
- Review and tighten SOC 2 CC6.1 (Logical Access) policies: prohibit copy‑pasting commands from unverified web sources.
- Capture and retain evidence of terminal command approvals via endpoint‑logging solutions for audit trails.
- Refresh security‑awareness training to include “command‑line phishing” scenarios and test with simulated exercises.
Source: Help Net Security
Technical Notes – The malicious page uses an iframe on Google Sites to serve a hidden /codexx/ path that delivers a Base64‑encoded curl command, which pipes into zsh. The final payload is a universal Mach‑O binary that runs on Intel and Apple‑Silicon Macs. No Linux payload observed. Source: Cato Networks analysis (linked above)