TLDR Tech / InfoSec
Cato CTRL Insights: When Trust Becomes the Payload in a Fake Codex ClickFix Campaign
Cato CTRL Insights has uncovered a fake Codex ClickFix campaign targeting macOS users, where sponsored search results redirected victims to Google Sites containing attacker-controlled iframes. Deceptive installers prompted users to copy Terminal commands that decoded URLs, retrieved shell loaders, and executed Mach-O payloads from /tmp/helper. This attack chain was observed sending 'event=pasted' telemetry, clearing quarantine attributes using `xattr -c`, and showing overlaps in delivery mechanisms with AMOS.
Read the full story