Search: “OpenAI Codex”

4 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 16 Vulnerability 13 Threat actor 5 Malware 4 AI safety & security 2 Ransomware 2 Industry 2 Data breach 2 Phishing & fraud 1

SeverityAll critical 25 high 15 medium 5 low 0 info 2

Fake OpenAI Codex download tricks macOS users into installing malware

Cato Networks uncovered a malware campaign using sponsored search ads and fake OpenAI Codex pages to deliver an AMOS-like infostealer to macOS users.

Cato Networks researchers discovered a campaign using sponsored search results and a fake OpenAI Codex download portal on Google Sites to lure macOS users. Victims are instructed to paste a Terminal command that decodes a Base64-encoded URL and runs a multi-stage infection chain ending in a universal Mach-O binary. The delivery chain closely resembles Atomic macOS Stealer (AMOS), and related infrastructure impersonating Claude Code was also found. Operators use iframe-based hosting and path/device gating to evade analysts and automated scanners.

Help Net SecurityAug 25, 00:00 UTC · 22d agoMalware in the wild

Attackers hijack HBO Max’s Reddit account for 48-hour malvertising blitz

Attackers hijacked HBO Max's verified Reddit account to push 108 ClickFix infostealer ads delivering AMOS, MacSync, and crypto clippers.

Threat actors compromised the verified u/hbomax Reddit account and ran 108 ClickFix malvertising ads in 48 hours as part of the PasteSwitch operation, analyzed by Hudson Rock and ADAMnetworks. macOS victims received curl-to-zsh payloads (MacSync, AMOS Helper, fake Ledger/Trezor/Exodus wallets harvesting BIP39 seed phrases); Windows users got Amatera via mshta and PowerShell loaders. Clipper C2 addresses are stored in Binance Smart Chain smart contracts, with 36 mainnet changes observed between March and July 2026.

Help Net Securityupdated Sep 15, 11:51 UTC · 19h agofirst Sep 15, 10:10 UTC · 20h agoMalware in the wild 7 sources

Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR

Help Net SecurityMar 15, 00:00 UTC · Mar 15, 2026Malware in the wildCVE-2026-21262 CVE-2026-26127

Week in review: Infostealer dropped via FortiClient EMS flaw, exploited Trend Micro Apex One flaw

Help Net SecurityMay 31, 00:00 UTC · May 31, 2026Malware in the wildCVE-2026-45659 CVE-2026-34926 CVE-2026-35616