Cato found advertisements and fake Codex pages distributing Mac malware.
Source: Cato NetworksAugust 24 dates Cato’s report; earlier related mentions exist.
Editorial analogy: a shop sign can copy a familiar brand while the goods behind the counter come from someone else.
An analogy for the mechanism; not an additional claim about the incident.Active Mac payload delivery; Linux delivery was not observed. Cato Networks
Victim infections and losses are unconfirmed.
Attacker AI use is unproven.
AMOS malware linkage is an assessment.
Editorial lesson: choose a trusted route to software before a search result asks you to install it. Familiar branding and professional-looking pages do not establish who is giving the instructions.
Attackers built lures; execution required user action. Cato Networks
Cato says it blocked associated infrastructure. Cato Networks
Editorial connections for organizations protecting their own users and devices. These controls do not establish what any victim lacked or guarantee prevention.
Provide approved software downloads and a clear place to ask about unexpected installation instructions.
A legitimate hosting service may contain content that your organization has not reviewed.
Assess suspicious browsing alongside commands, new programs and network activity, within authorized monitoring.
Visiting a page is not proof that its instructions ran. Blocking a destination does not establish that every exposed device is clean.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Oct 13, 2026 · Editorial methodology · Structured data