Search: “Codex”

5 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 65 AI industry 42 AI safety & security 31 Exploit / PoC 29 AI tools & infra 23 Malware 19 AI research 14 Model release 14 Threat actor 13 Ransomware 10 Industry 8 Data breach 6 Policy & legal 6 Research 5

SeverityAll critical 64 high 45 medium 64 low 12 info 114

Fake OpenAI Codex download tricks macOS users into installing malware

Cato Networks uncovered a malware campaign using sponsored search ads and fake OpenAI Codex pages to deliver an AMOS-like infostealer to macOS users.

Cato Networks researchers discovered a campaign using sponsored search results and a fake OpenAI Codex download portal on Google Sites to lure macOS users. Victims are instructed to paste a Terminal command that decodes a Base64-encoded URL and runs a multi-stage infection chain ending in a universal Mach-O binary. The delivery chain closely resembles Atomic macOS Stealer (AMOS), and related infrastructure impersonating Claude Code was also found. Operators use iframe-based hosting and path/device gating to evade analysts and automated scanners.

Help Net SecurityAug 25, 00:00 UTC · 22d agoMalware in the wild

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.

Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.

GBHackersupdated Sep 10, 10:36 UTC · 5d agofirst Sep 9, 07:05 UTC · 6d agoMalware in the wild 4 sources1

Fake Codex Download Uses Google Sites to Deliver macOS Malware

Fake OpenAI Codex download pages on Google Sites, pushed via sponsored search and ClickFix lures, deliver malware to macOS users.

Threat actors are hosting fake Codex download pages on Google Sites and promoting them through sponsored search results. Victims are walked through ClickFix social engineering that leads to malware installation on macOS systems. The campaign abuses trusted Google infrastructure and search ads to reach Mac users.

Infosecurity MagazineAug 24, 15:00 UTC · 22d agoMalware

FOMO in the SOC: Where AI Platforms like Claude Actually Fit

The Hacker NewsAug 3, 11:30 UTC · Aug 3, 2026Malware

AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers

The Hacker NewsJul 8, 17:02 UTC · Jul 8, 2026Malware1