Reported by 2 outlets
Hackers Place Fake Codex Download Above Legitimate OpenAI Result to Infect Mac Users
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Hackers Place Fake Codex Download Above Legitimate OpenAI Result to Infect Mac Users
gbhackers.com · 49d ago · August 25th, 2026
Threat actors are using sponsored Google Search ads to place a fake OpenAI Codex download page above the legitimate result, steering macOS users into manually executing malware through Terminal. The operation begins when users search for Codex-related terms, including “codex macos download.” Instead of selecting OpenAI’s legitimate listing, victims may encounter a sponsored result that […] The post Hackers Place Fake Codex Download Above Legitimate OpenAI Result to Infect Mac Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Fake OpenAI Codex Installer Tricks Mac Users Into Pasting Malware Into Terminal
cyberpress.org · 49d ago · August 25th, 2026
The campaign uses ClickFix, a social-engineering technique that convinces victims to manually paste and execute a command instead of downloading a clearly malicious file. The attack begins with sponsored Google search results for queries such as “codex macos download.” These ads appear above legitimate OpenAI links and redirect users to convincing Google Sites pages impersonating a Codex download portal. The pages display macOS and Linux download options, although researchers observed active malware delivery only for macOS users. Google Sites provides the initial layer of trust, but it does not host the active malicious content. Instead, the lure embeds an attacker-controlled external page through an iframe. This setup lets attackers use a reputable Google-hosted domain for credibility while changing their ClickFix content, payload hosts, and infrastructure independently. Fake Codex Terminal Malware When a macOS visitor selects the fake download option, the page instructs them to open Terminal and paste a command. The command resembles a legitimate Codex npm installation process, but it secretly decodes a Base64-encoded URL and retrieves a remote script. That script is then piped into zsh for execution. Fake installer prompts a Terminal command (Source: catonetworks) The infection chain has three stages. First, the pasted command downloads a shell-script load