Search: “OpenAI Codex”

12 items

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 53 AI industry 40 Exploit / PoC 27 AI safety & security 25 AI tools & infra 14 Malware 12 Model release 9 Threat actor 8 AI research 7 Ransomware 6 Industry 5 Data breach 4 Research 4 Tools 3

SeverityAll critical 54 high 30 medium 45 low 7 info 87

Fake OpenAI Codex download tricks macOS users into installing malware

Cato Networks uncovered a malware campaign using sponsored search ads and fake OpenAI Codex pages to deliver an AMOS-like infostealer to macOS users.

Cato Networks researchers discovered a campaign using sponsored search results and a fake OpenAI Codex download portal on Google Sites to lure macOS users. Victims are instructed to paste a Terminal command that decodes a Base64-encoded URL and runs a multi-stage infection chain ending in a universal Mach-O binary. The delivery chain closely resembles Atomic macOS Stealer (AMOS), and related infrastructure impersonating Claude Code was also found. Operators use iframe-based hosting and path/device gating to evade analysts and automated scanners.

Help Net SecurityAug 25, 00:00 UTC · 22d agoMalware in the wild

Fake Codex Download Uses Google Sites to Deliver macOS Malware

Fake OpenAI Codex download pages on Google Sites, pushed via sponsored search and ClickFix lures, deliver malware to macOS users.

Threat actors are hosting fake Codex download pages on Google Sites and promoting them through sponsored search results. Victims are walked through ClickFix social engineering that leads to malware installation on macOS systems. The campaign abuses trusted Google infrastructure and search ads to reach Mac users.

Infosecurity MagazineAug 24, 15:00 UTC · 22d agoMalware

AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers

The Hacker NewsJul 8, 17:02 UTC · Jul 8, 2026Malware1

SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self

The Hacker NewsJul 6, 06:55 UTC · Jul 6, 2026Malware

Attackers hijack HBO Max’s Reddit account for 48-hour malvertising blitz

Attackers hijacked HBO Max's verified Reddit account to push 108 ClickFix infostealer ads delivering AMOS, MacSync, and crypto clippers.

Threat actors compromised the verified u/hbomax Reddit account and ran 108 ClickFix malvertising ads in 48 hours as part of the PasteSwitch operation, analyzed by Hudson Rock and ADAMnetworks. macOS victims received curl-to-zsh payloads (MacSync, AMOS Helper, fake Ledger/Trezor/Exodus wallets harvesting BIP39 seed phrases); Windows users got Amatera via mshta and PowerShell loaders. Clipper C2 addresses are stored in Binance Smart Chain smart contracts, with 36 mainnet changes observed between March and July 2026.

Help Net Securityupdated Sep 15, 11:51 UTC · 21h agofirst Sep 15, 10:10 UTC · 22h agoMalware in the wild 7 sources

Malicious AI agent skills can slip past the scanners built to stop them

Help Net SecurityJul 9, 00:00 UTC · Jul 9, 2026Malware

Hades PyPI Attack: 19 Packages Poisoned to Auto

The Hacker NewsJun 9, 10:34 UTC · Jun 9, 2026Malware

PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud Environments

The Hacker NewsJun 15, 00:00 UTC · Jun 15, 2025Malware1

Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR

Help Net SecurityMar 15, 00:00 UTC · Mar 15, 2026Malware in the wildCVE-2026-21262 CVE-2026-26127

ChatGPT shows promise of using AI to write malware

CyberScoopDec 6, 21:41 UTC · Dec 6, 2022Malware

Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself

The Hacker NewsAug 5, 07:53 UTC · Aug 5, 2026Malware

Week in review: Infostealer dropped via FortiClient EMS flaw, exploited Trend Micro Apex One flaw

Help Net SecurityMay 31, 00:00 UTC · May 31, 2026Malware in the wildCVE-2026-45659 CVE-2026-34926 CVE-2026-35616