CATO CTRL INSIGHTS: WHEN TRUST BECOMES THE PAYLOAD IN A FAKE CODEX CLICKFIX CAMPAIGN

Summary from the TLDR InfoSec newsletter

Sponsored Codex searches routed macOS users to Google Sites lures with attacker-controlled iframes. Fake installers copied Terminal commands that decoded URLs, fetched shell loaders, and launched Mach-O payloads from /tmp/helper. The chain sent event=pasted telemetry, cleared quarantine attributes with xattr -c, and showed delivery overlap with AMOS.