Search: “Codex”

15 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 65 AI industry 42 AI safety & security 31 Exploit / PoC 29 AI tools & infra 23 Malware 19 Model release 14 Threat actor 13 AI research 13 Ransomware 10 Industry 8 Policy & legal 6 Data breach 6 Phishing & fraud 5

SeverityAll critical 64 high 45 medium 64 low 12 info 113

Fake OpenAI Codex download tricks macOS users into installing malware

Cato Networks uncovered a malware campaign using sponsored search ads and fake OpenAI Codex pages to deliver an AMOS-like infostealer to macOS users.

Cato Networks researchers discovered a campaign using sponsored search results and a fake OpenAI Codex download portal on Google Sites to lure macOS users. Victims are instructed to paste a Terminal command that decodes a Base64-encoded URL and runs a multi-stage infection chain ending in a universal Mach-O binary. The delivery chain closely resembles Atomic macOS Stealer (AMOS), and related infrastructure impersonating Claude Code was also found. Operators use iframe-based hosting and path/device gating to evade analysts and automated scanners.

Help Net SecurityAug 25, 00:00 UTC · 21d agoMalware in the wild

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.

Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.

GBHackersupdated Sep 10, 10:36 UTC · 5d agofirst Sep 9, 07:05 UTC · 6d agoMalware in the wild 4 sources1

Fake Codex Download Uses Google Sites to Deliver macOS Malware

Fake OpenAI Codex download pages on Google Sites, pushed via sponsored search and ClickFix lures, deliver malware to macOS users.

Threat actors are hosting fake Codex download pages on Google Sites and promoting them through sponsored search results. Victims are walked through ClickFix social engineering that leads to malware installation on macOS systems. The campaign abuses trusted Google infrastructure and search ads to reach Mac users.

Infosecurity MagazineAug 24, 15:00 UTC · 22d agoMalware

FOMO in the SOC: Where AI Platforms like Claude Actually Fit

The Hacker NewsAug 3, 11:30 UTC · Aug 3, 2026Malware

AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers

The Hacker NewsJul 8, 17:02 UTC · Jul 8, 2026Malware

SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self

The Hacker NewsJul 6, 06:55 UTC · Jul 6, 2026Malware

Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR

Help Net SecurityMar 15, 00:00 UTC · Mar 15, 2026Malware in the wildCVE-2026-21262 CVE-2026-26127

ChatGPT shows promise of using AI to write malware

CyberScoopDec 6, 21:41 UTC · Dec 6, 2022Malware

HBO Max Reddit Account Hijacked to Spread PasteSwitch ClickFix Malware

Hijacked HBO Max verified Reddit account ran 108 ClickFix malvertising ads delivering AMOS and Amatera stealers plus crypto clippers to macOS and Windows users.

Threat actors hijacked HBO Max's verified Reddit account (u/hbomax) to run 108 malicious ClickFix ads over 48 hours in a campaign tracked as PasteSwitch, researched by Hudson Rock and ADAMnetworks. macOS victims were served curl | zsh chains deploying MacSync and Atomic macOS Stealer (AMOS), which harvest browser credentials, Telegram data, Apple Notes, and macOS passwords, while fake Ledger, Trezor, and Exodus apps targeted BIP39 seed phrases. Windows users received an InstallFix chain using an MP3/HTA polyglot with mshta and PowerShell, scheduled-task persistence, AMSI disabling, and in-memory Amatera Stealer that hid C2 traffic (77.91.65.13:443) behind a facebook.com TLS SNI. AnimateClipper and ZigClipper components swapped copied crypto wallet addresses and used Binance Smart Chain contracts as mutable C2 dead drops; Reddit paused the ads and the initial access path remains undisclosed.

GBHackersupdated 11:51 UTC · 11h agofirst 05:22 UTC · 17h agoMalware 7 sources

Search: “Codex”

Fake OpenAI Codex download tricks macOS users into installing malware

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Fake Codex Download Uses Google Sites to Deliver macOS Malware

FOMO in the SOC: Where AI Platforms like Claude Actually Fit

AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers

SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self

Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR

ChatGPT shows promise of using AI to write malware

HBO Max Reddit Account Hijacked to Spread PasteSwitch ClickFix Malware

Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself

Malicious AI agent skills can slip past the scanners built to stop them

Hades PyPI Attack: 19 Packages Poisoned to Auto

Week in review: Infostealer dropped via FortiClient EMS flaw, exploited Trend Micro Apex One flaw

MagentoCore group hacks 7,339 stores and counting

PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud Environments