Attackers ran sponsored search ads that led macOS users to a fake “OpenAI Codex” download page hosted on Google Sites. The site used “ClickFix” style instructions to convince victims to open Terminal and paste a command that quietly downloaded and ran a multi-stage macOS malware chain.
Attackers placed sponsored search ads targeting queries such as codex macos download. Clicking these ads sent macOS users to a page hosted on Google Sites that impersonated an OpenAI Codex download portal. Rather than delivering a direct installer file, the page used ClickFix style instructions, telling visitors to open Terminal and paste a command to complete installation.
That pasted command decoded a hidden URL and retrieved a shell script, which continued a multi-stage infection chain. The chain ran through three stages before ending in a Mach-O payload. Before execution, the payload was staged in a temporary directory and its extended attributes were stripped, removing the quarantine metadata that normally triggers macOS warnings about internet-downloaded files.
The campaign relied on several layers of trust manipulation rather than a single trick:
Together, these elements made the page look legitimate at a glance and reduced the chances that a victim, or a reviewer, would notice anything wrong before the payload executed.
Organizations with macOS users, especially developers and engineering teams who frequently install command-line tools, should reinforce a few habits: navigate directly to official vendor sites rather than clicking sponsored search results, treat any request to paste a Terminal command from a webpage as a red flag unless the source is verified, and report suspicious installers even when no security warning appears, since this campaign specifically stripped the metadata that would normally trigger one. IT support and helpdesk staff should be briefed on this pattern so they can recognize and escalate similar reports quickly.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Sponsored search results for terms like codex macos download led victims to a Google Sites page impersonating an OpenAI Codex download portal, which used ClickFix style instructions to get users to open Terminal and paste a command.
The command decoded a hidden URL and retrieved a shell script that continued a multi-stage infection chain, ultimately downloading a Mach-O payload while stripping quarantine metadata to avoid macOS security warnings.
No, the report describes attackers embedding attacker-controlled content via an iframe so the trusted Google Sites domain hosted the initial page while the active malicious content lived on separate infrastructure.
Developers, engineering teams, IT support staff, and general macOS users who search for and download developer tools are the primary targets described.
You search “codex macos download,” click the top sponsored result, and land on a slick “OpenAI Codex” page on Google Sites. The page says Codex needs a manual install: it shows a big code block and tells you, “Open Terminal on your Mac and paste this command to install Codex.” That one paste silently pulls down scripts and a Mach-O malware payload. Here’s the trap: real OpenAI tools don’t install from a random Google Sites page, and legit installers don’t make you paste an opaque Terminal command that hides URLs, drops files in /tmp, then strips macOS quarantine so you never see a warning. If a download page tells you to paste a Terminal command from the web, stop. Close it, go directly to the vendor’s official site yourself, and download from there instead.
Researchers demonstrated a technique that can trick xAI’s Grok into leaking a user’s chat prompts and some session details to an attacker-controlled server when the user asks Grok to summarize a web page. The attack hides malicious instructions inside encrypted content on the page, which Grok is…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Zenity demonstrated real-world attack chains where hidden instructions in emails or content on X can hijack AI “agentic browsers” (ChatGPT Atlas and the Claude Chrome extension). In the demos, the AI agent can be steered to perform actions in the user’s already logged-in sessions, sending phishing…
Researchers showed how a malicious web page could trick OpenAI’s Atlas AI-enabled browser into taking actions a user didn’t intend, like spamming WhatsApp contacts or modifying an Amazon account. The attacks used prompt-injection style instructions hidden in a seemingly legitimate “newsletter…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
