high1 source
Fake OpenAI Codex Downloads Target macOS Users via Google Sites and ClickFix
A malicious campaign has leveraged sponsored search results and legitimate Google Sites hosting to distribute macOS malware under the guise of an OpenAI Codex download. The attackers used operating-system-aware gating and iframes to evade detection while directing users to execute manual terminal commands via ClickFix social engineering. The resulting multi-stage infection chain strips quarantine attributes from the payload, showing strong operational overlaps with known Atomic Stealer delivery frameworks.
Read more about Fake OpenAI Codex Downloads Target macOS Users via Google Sites and ClickFix