Security researchers have uncovered a campaign in which cybercriminals are exploiting Google Sites to host deceptive download pages claiming to offer OpenAI Codex. The scheme relies on paid Google Ads to promote links like “codex macos download,” which when clicked, send users to a Google Sites page designed to mimic an official Codex installer—primarily targeting macOS users.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
Rather than distributing a malware-laden file directly, the fake pages prompt visitors to copy a terminal command and run it on their systems. This method—known as a “ClickFix” attack—effectively shifts the final step of installation onto the user, making the malware delivery appear legitimate.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
How the Deception Works
The attack chain begins with ads appearing above legitimate search results. These ads guide users to Google Sites pages that look like authentic Codex download sites. While options for both macOS and Linux are displayed, researchers observed that only macOS users were served malicious content.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
The pages use attacker-controlled iframes under Google Sites to maintain a trusted domain appearance, even though the content loaded within is completely controlled by the bad actors. To evade detection, these attackers hide the malicious content behind urls like “/codexx/” while leaving “/codex/” routes clean—this misdirection helps avoid scrutiny from users, security tools, and automated systems.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
Payload Delivery & Technical Details
Once a macOS user pastes and runs the suggested command, a three-stage delivery chain is activated. The initial script decodes embedded data that leads to a second script. That script issues a final payload—a Mach-O malware file—that’s placed in “/tmp/helper,” stripped of extended attributes (via “xattr -c”), made executable, and then launched.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
These tactics show notable overlap with AMOS (Atomic macOS Stealer), including encoded curl loaders, hidden scripting via zsh, telemetry collection, and use of the same staging location. Researchers warned that even though the final malware may differ, the reuse of infrastructure makes detection and response easier.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
The investigation includes a list of indicators of compromise (IoCs), such as specific Google Sites URLs, attacker domains hosting iframes, script and payload hosts, telemetry hosts, and unique SHA-256 hashes tied to macOS malware samples.· Examples include fake lures on sites[.]google[.]com/view/cod…, iframe domains like bright-links[.]com, payload hosts such as trekmesh15[.]com, and telemetry endpoints like grove-12[.]com.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
Advice to Stay Safe
Defenses start with skepticism toward unsolicited ads offering installers and any webpage that asks users to paste commands into Terminal. Trusted vendor or official download channels should always be used. On the detection side, organizations are urged to monitor for suspicious behaviors: decode-then-execute scripts, Base64 data decoding, downloads triggered from hidden or misaligned URLs, removal of extended file attributes, and new executables appearing under “/tmp/helper.”([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
Network security tools should block or flag infrastructure used in the attack—iframe hosts, payload servers, telemetry endpoints—combined with real-time behavior monitoring rather than static domain blacklist use.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
This campaign forms part of a broader pattern in which attackers use sponsored searches and familiar software names to lure users, such as past cases involving fake Node.js installer ads.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-abuse-google-sites/))
These kinds of attacks represent a rising threat for macOS users and software ecosystems relying on developer tools. As adversaries continue blending trusted platforms and familiar brand names into complex delivery chains, vigilance must rise. Watch for overhyped claims, misleading URLs, and anything asking for unexpected Terminal activity; strong defenses require both technical controls and user awareness.
