Fake OpenAI Codex download tricks macOS users into installing malware

Cato Networks identified an active macOS malware campaign that used sponsored search ads and Google Sites landing pages impersonating developer tools (OpenAI Codex and Claude Code) to trick users into pasting a Base64-decoded command into Terminal; the command pipes obfuscated zsh stages that fetch and execute a universal Mach-O payload. The attackers used iframe-hosted interchangeable content and device gating to evade analysis, and the delivery chain and artifacts strongly overlap with the Atomic macOS Stealer family.