Some Mac users think they're installing OpenAI Codex, but it's actually a malware that can steal passwords in seconds

Mac users were led to believe they were installing OpenAI Codex, but in reality, they fell victim to a malware known as AMOS. This malicious software can swiftly steal passwords. The cybercriminals behind this campaign utilized Google Sites and stolen Google Ads accounts to promote fake OpenAI Codex pages. Unsuspecting macOS users, seeking a download for the AI coding agent, clicked on what appeared to be the official OpenAI download site for Codex.

However, the page was a clever ruse, hosting an iFrame that displayed content from a different source. By leveraging Google Sites and Google Ads, the criminals aimed to create a convincing and trustworthy appearance, capitalizing on users' trust in Google's search results. The deceptive installation process tricked users into pasting a Terminal command, ultimately leading to the deployment of the AMOS infostealer, a threat capable of extracting sensitive data such as browser information, login credentials, and cryptocurrency wallet details.