# macOS malware impersonation campaigns > Live situation record from CLSTR: https://clstr.news/situations/macos-malware-impersonation-campaigns > Updated: 2026-08-25T09:15:00.000Z. Sources: 3. Developments: 2. Cybercriminals are employing various methods to target macOS users through impersonation and fraudulent software downloads. Initially, attackers utilized GitHub by creating copycat repositories for popular applications such as VLC Media Player, Figma, Malwarebytes, and 1Blocker. These repositories used anonymous accounts and fake support emails to exploit search engine rankings and direct users to malicious JavaScript hosted on fraudulent pages. More recent activity has shifted toward using fraudulent Google Ads and Google Sites to impersonate OpenAI Codex. This campaign directs developers to landing pages that utilize a ‘ClickFix’ technique, instructing victims to execute commands in the macOS Terminal under the guise of a necessary installation step. This process triggers a multi-stage malware infection, which researchers have linked to the Atomic macOS Stealer (AMOS) infostealer. The malware is capable of running on both Intel and Apple Silicon systems and includes mechanisms to bypass macOS security flags. ## Timeline ### 2026-08-25: Cybercriminals use fake OpenAI Codex ads to target macOS users Hackers are using fake OpenAI Codex ads and Google Sites to trick macOS users into running malware via a ‘ClickFix’ technique that prompts victims to execute malicious commands in the Terminal. 3 sources. https://clstr.news/cluster/cybercriminals-use-fake-openai-codex-ads-to-target-macos-users ### 2026-08-16: GitHub hosts malware scam using copycat macOS app repositories Malware scammers are using fake GitHub repositories to impersonate popular macOS applications like VLC and Figma to distribute malicious software via SEO manipulation. 3 sources. https://clstr.news/cluster/github-hosts-malware-scam-using-copycat-macos-app-repositories --- Cite as: macOS malware impersonation campaigns. CLSTR, https://clstr.news/situations/macos-malware-impersonation-campaigns