As artificial intelligence transitions from standalone productivity assistants to deeply embedded enterprise workflows, threat actors have adapted their strategies to exploit this new attack surface. Based on intelligence gathered across 6.7 trillion global network flows, this report exposes how shadow AI, prompt injection, and weaponized automation extensions are challenging standard defense models and forcing organizations to reimagine enterprise risk governance.
The 2026 Cato CTRL Threat Report details a critical evolution in cybercrime: attackers are moving beyond traditional software vulnerabilities to target the implicit trust, wide permissions, and automated capabilities of AI systems.
How cybercriminals weaponized Google’s trusted platforms to deliver infostealers through AI developer tools
The developer was excited. A quick search for “Codex macOS download” brought up a sponsored result right at the top of Google’s search page. Clicking through, they landed on what looked like a legitimate OpenAI Codex download portal hosted on Google Sites, no less. Trustworthy, right?
Wrong.
The page didn’t ask them to download anything. Instead, it instructed them to open Terminal and paste a command to “install Codex.” It looked like a routine npm install string. But behind that innocuous-looking command, a multi-stage malware delivery chain was about to unfold one that would ultimately deliver the Atomic macOS Stealer (AMOS) straight to their machine.
This is the reality of the “Fake Codex ClickFix” campaign uncovered by Cato CTRL, the threat intelligence team at Cato Networks . The campaign represents a sophisticated evolution in social engineering: attackers are now weaponizing the trust users place in Google’s own platforms to bypass security defenses and deliver malware through a technique known as “ClickFix” .
How the Attack Works: Trust as a Weapon
The campaign, first detected in 2025 and continuing into 2026, leverages a multi-stage attack chain that exploits both technical and psychological vulnerabilities .
Stage 1: The Sponsored Search Result
Attackers purchased sponsored Google Ads targeting search terms like “codex macos download.” The ad appears above OpenAI’s legitimate listing, making it the first result users see . As Cato researchers noted, the campaign “combines a paid advertisement, a legitimate Google-hosted page, and a recognised software brand” to “build a route that looks trustworthy at every early stage” .
Stage 2: The Fake Landing Page
Clicking the ad leads to a page on Google Sites a legitimate Google-hosted platform . The page mimics the official Codex download portal, complete with macOS and Linux download buttons. However, no malicious code is hosted directly on the Google Sites page. Instead, the page loads content through an iframe from an attacker-controlled domain .
This separation is deliberate: “This separation lets the attacker combine a trusted hosting domain with independently controlled ClickFix content,” explained Cato Networks researchers Jakub Osmani and Guy Waizel .
Stage 3: The ClickFix Command
Visitors see a command and are instructed to paste it into Terminal. The command begins with a plausible npm install string, but includes a hidden Base64-encoded URL that retrieves and executes a malicious script .
This “ClickFix” technique shifts the final execution step to the victim, bypassing the suspicion that would normally be raised by an unexpected download .
Stage 4: The Multi-Stage Delivery Chain
The pasted command triggers three stages of execution :
Stage 1: A shell script loader decodes an embedded component and runs it through eval.
Stage 2: The decoded script sends a telemetry request to an attacker endpoint with event=pasted – recording that someone ran the command – then downloads the final payload to /tmp/helper.
Stage 3: The loader clears the file’s extended attributes with xattr -c (removing the download quarantine metadata that would normally trigger a warning), makes it executable, and launches it. The final payload is a universal Mach-O binary that runs on both Intel and Apple Silicon Macs.
The Evasion Techniques
The attackers employed multiple techniques to evade detection :
- Path-Based Gating: The live ClickFix content is served at
/codexx/, while the more obvious/codex/path returns a harmless product page. A request that doesn’t match the attacker’s intended path may never receive the ClickFix content . - OS-Based Filtering: Non-macOS visitors are served benign content, frustrating automated scanners .
- Infrastructure Rotation: The operators continuously rotate domains and payload locations, making static indicators unreliable .
- Layer Diversification: Between infrastructure sets, the loader has been reworked from compressed/Base64-encoded second stages to AES-encrypted gzip containers with decryption keys reconstructed from several variables .
The Payload: Atomic macOS Stealer (AMOS)
Cato CTRL tied the delivery framework to Atomic macOS Stealer (AMOS) a commodity infostealer designed to capture credentials, cryptocurrency wallets, and sensitive data from macOS systems .
The connection was established through multiple overlaps :
- The loader URL structure
- The
event=pastedtelemetry request - The staging path (
/tmp/helper) - The removal of extended attributes
- Update-themed payload URLs
“Researchers described the match as strong and consistent with AMOS delivery activity,” SiliconANGLE reported . The final payload is a Mach-O binary, so it runs on both Intel and Apple Silicon Macs.
Why This Matters: The Bigger Picture
Abuse of Trusted Platforms
This campaign represents a troubling evolution: attackers are weaponizing the trust users place in Google’s own ecosystem . As the Cato researchers concluded, “trust becomes the payload” .
By using Google Ads and Google Sites, attackers bypass traditional security assumptions:
- Google Sites hosts the landing page, so it passes URL reputation checks
- Google Ads place the malicious link above legitimate results
- The iframe separation means the Google Sites page itself contains no malicious code
- The ClickFix technique means no download occurs the user executes the payload themselves
The AI Developer Tool Targeting Trend
The Fake Codex campaign is part of a broader pattern: attackers are using the popularity of AI developer tools as lures .
Previous campaigns targeted:
- Claude Code installers (March-May 2025)
- Node.js installers via sponsored ads
- AI tools represent a perfect lure they’re sought after by developers who are comfortable executing Terminal commands and may lower their guard when seeking productivity tools.
The Shadow AI Risk
This campaign underscores a critical point raised in the 2026 Cato CTRL Threat Report: shadow AI is the top security risk for organizations .
“Shadow AI is a mirror of organizational behavior: where governance lags, risk fills the gap,” warned Etay Maor, VP of Threat Intelligence at Cato Networks .
The report found that AI adoption is effectively universal, with 20 out of 25 industry verticals showing adoption rates of 90% or higher by Q4 2025 . This widespread adoption, combined with employees seeking productivity gains through unsanctioned tools, creates a perfect storm .
Why This Matters for MEA Organizations
Organizations in the Middle East and Africa face amplified risk from these campaigns:
Rapid Digital Transformation: As MEA organizations accelerate their digital transformation, employees are increasingly adopting AI tools often without IT approval. The region’s growing developer community makes AI coding tools a particularly attractive target.
Trust in Global Platforms: Organizations may assume that platforms like Google and Microsoft are inherently safe, leaving them vulnerable to campaigns that abuse these platforms’ trust.
Limited AI Governance: Many organizations in the region are still developing AI governance frameworks, making them more susceptible to shadow AI risks.
Supply Chain Implications: A compromised developer tool in one organization could lead to credential theft that cascades through supply chains.
Training Gaps: Without awareness training on ClickFix techniques and AI-specific threats, employees may unknowingly execute malicious commands especially when they appear to come from trusted sources.
10 Urgent Actions for Security Teams
Based on Cato CTRL’s findings and the broader AI threat landscape, organizations should take immediate action :
1. Extend Security Monitoring to AI Workflows
Monitor AI interactions, prompts, responses, and downstream actions for anomalous behavior. Correlate AI activity with user behavior, network traffic, and application logs to identify abuse patterns .
2. Treat AI Inputs as Untrusted Data by Default
Apply input validation, sanitization, and context isolation to all data ingested by AI tools, including metadata, URLs, and file fragments. Enforce content inspection before AI systems process external inputs .
3. Discover and Inventory AI Usage
Identify all AI services in use across your organization, including browser-based and embedded tools. Implement CASB controls to gain visibility into unsanctioned AI usage .
4. Define and Enforce AI Usage Policies
Create clear policies for approved AI tools. As Etay Maor noted: “Enable safe alternatives, giving employees approved AI tools that meet business needs. Apply granular policies, rather than binary allow/deny decisions” .
5. Educate Users on AI-Specific Threats
Train employees to recognize that “AI is not a neutral workplace but an external system with memory and consequences” . Include ClickFix techniques in security awareness training.
6. Never Paste Commands from Search Results
Establish a clear policy: never paste Terminal commands from websites discovered through search results, especially sponsored results. Always obtain software from official vendor websites .
7. Treat AI Tools as Potential Malware Vectors
Apply the same security scrutiny to AI tool downloads as to any other software. Don’t trust a platform simply because the landing page is hosted on a legitimate domain .
8. Enforce Least Privilege for AI Agents
Apply strict least-privilege access to AI tools, restricting them to only the data and actions required. Separate read, write, and execution privileges .
9. Extend Security Controls to Cloud Platforms
Implement DLP and CASB protections to monitor data flows to cloud platforms. The Fake Codex campaign demonstrates how attackers are abusing trusted cloud platforms.
10. Share Threat Intelligence
Report suspicious activity to relevant CERTs and industry groups. The attackers are rotating infrastructure and brands, collective defense is essential .
What This Means for the Future
The Fake Codex ClickFix campaign represents a significant escalation in cybercrime tactics. By weaponizing trust in legitimate platforms and AI developer tools, attackers have created a new class of threats that bypass traditional security controls.
Cato CTRL’s research, based on analysis of 6.7 trillion network flows across more than 4,000 global customers, reveals that AI has become a fundamental part of the attack landscape .
“Threat actors are no longer just exploiting AI systems. They are exploiting AI trust, workflows, and capabilities themselves,” the 2026 Cato CTRL Threat Report concluded . “AI has become a new attack surface that challenges security assumptions and demands AI-aware defense strategies.”
The organizations that succeed will be those who treat AI as a core part of their security and risk model .
Conclusion
The Fake Codex ClickFix campaign is a wake-up call. Attackers are weaponizing the very platforms and tools we trust – Google Ads, Google Sites, and the promise of AI productivity – to deliver malware directly into our systems.
The command you’re about to paste might look like it’s installing an AI coding tool. But in reality, it could be delivering an infostealer that captures your credentials, drains your cryptocurrency wallets, and compromises your organization.
No single stage of this attack reliably exposes the threat. As the Cato researchers warned, “detection depends on correlating search delivery, embedded content, Terminal execution, and outbound activity” .
In an era where trust becomes the payload, the question is no longer whether your employees will encounter these threats, it’s whether they’ll recognize them before it’s too late.
For more cybersecurity news and analysis, visit CyberCory.com, your trusted source for security intelligence. For comprehensive cybersecurity training and awareness programs, explore solutions at Saintynet.com.
