Crooks push Mac malware through fake OpenAI Codex ads
- ID
- 17553
- Status
- summarized
- Published
- 25 Aug 2026, 5:15 PM
- Fetched
- 25 Aug 2026, 5:31 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/25/crooks-push-mac-malware-through-fake-openai-codex-ads/5291899
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.5
- Created
- 25 Aug 2026, 5:32 PM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
Attackers are buying sponsored Google search results for "OpenAI Codex" downloads and directing Mac developers to fake Google Sites pages that mimic OpenAI branding. Instead of an installer, victims are told to paste a Terminal command that looks like an npm install but decodes a Base64 URL, fetches a shell script, and downloads a universal Mach-O infostealer to /tmp/helper while stripping macOS security flags. Cato Networks found strong similarities to the Atomic macOS Stealer (AMOS) family.
Why it matters
If you or your team search for Codex or other AI coding tools and click the top sponsored Google result, you may land on a lookalike page instructing you to run a terminal command—never paste installation commands from a download page you reached via an ad. Verify the official source URL before running anything, and treat any site that asks you to open Terminal and paste a command as suspicious until proven otherwise.
Discussion angle
The ClickFix pattern—getting victims to self-execute malicious commands by disguising them as install instructions—is now targeting AI tooling searches specifically; discuss how to set team policies for verifying download sources and whether blocking sponsored results or mandating official package managers reduces risk.