{
  "id": 3266547,
  "title": "Some Mac users think they're installing OpenAI Codex, but it's actually a malware that can steal passwords in seconds",
  "url": "https://urgent.news/2026/08/25/some-mac-users-think-theyre-installing-openai-codex-but-its-actually",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-25T12:35:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/some-mac-users-think-theyre-installing-openai-codex-but-its-actually-a-malware-that-can-steal-passwords-in-seconds"
  },
  "original_language": "en",
  "account": "Mac users were led to believe they were installing OpenAI Codex, but in reality, they fell victim to a malware known as AMOS. This malicious software can swiftly steal passwords. The cybercriminals behind this campaign utilized Google Sites and stolen Google Ads accounts to promote fake OpenAI Codex pages. Unsuspecting macOS users, seeking a download for the AI coding agent, clicked on what appeared to be the official OpenAI download site for Codex. However, the page was a clever ruse, hosting an iFrame that displayed content from a different source. By leveraging Google Sites and Google Ads, the criminals aimed to create a convincing and trustworthy appearance, capitalizing on users' trust in Google's search results. The deceptive installation process tricked users into pasting a Terminal command, ultimately leading to the deployment of the AMOS infostealer, a threat capable of extracting sensitive data such as browser information, login credentials, and cryptocurrency wallet details.",
  "summary": "An elaborate scheme was designed to deploy AMOS, a known macOS infostealer malware.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 7,
    "also_reported_by": [
      {
        "outlet": "9to5Mac",
        "title": "OpenAI restores 5-hour Codex and Work limits for ChatGPT Plus users",
        "url": "https://urgent.news/2026/08/25/openai-restores-5-hour-codex-and-work-limits-for-chatgpt-plus-users",
        "published": "2026-08-25T01:47:49.000Z"
      },
      {
        "outlet": "The Indian Express",
        "title": "ChatGPT for Teens promises safer AI. Will its safeguards work for Indian users?",
        "url": "https://urgent.news/2026/08/25/chatgpt-for-teens-promises-safer-ai-will-its-safeguards-work-for",
        "published": "2026-08-25T04:17:25.000Z"
      },
      {
        "outlet": "The Register",
        "title": "Crooks push Mac malware through fake OpenAI Codex ads",
        "url": "https://urgent.news/2026/08/25/crooks-push-mac-malware-through-fake-openai-codex-ads",
        "published": "2026-08-25T09:15:00.000Z"
      },
      {
        "outlet": "TechRadar",
        "title": "ChatGPT Plus costs me $20 a month — using it to question my spending has already saved me more than that",
        "url": "https://urgent.news/2026/08/25/chatgpt-plus-costs-me-20-a-month-using-it-to-question-my-spending-has",
        "published": "2026-08-25T10:40:55.000Z"
      },
      {
        "outlet": "CNBC",
        "title": "OpenAI bans Russian ChatGPT accounts used in covert misinformation campaign",
        "url": "https://urgent.news/2026/08/25/openai-bans-russian-chatgpt-accounts-used-in-covert-misinformation",
        "published": "2026-08-25T11:21:09.000Z"
      },
      {
        "outlet": "Quartz",
        "title": "OpenAI banned Russian ChatGPT accounts used to spread pro-Kremlin misinformation",
        "url": "https://urgent.news/2026/08/25/openai-banned-russian-chatgpt-accounts-used-to-spread-pro-kremlin",
        "published": "2026-08-25T12:20:33.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}