Crooks push Mac malware through fake OpenAI Codex ads
Threat actors are leveraging fake OpenAI Codex advertisements in sponsored search results to distribute ClickFix malware to developers. The malicious ads redirect unsuspecting victims to pages designed to trick them into installing malware through social engineering tactics typical of ClickFix campaigns.
A malware campaign discovered by Cato Networks exploits sponsored search ads to direct macOS users to a fake OpenAI Codex download page, where victims are socially engineered into pasting malicious commands directly into Terminal. The attack uses a variation of the ClickFix technique, which manipulates users into executing the infection themselves rather than opening a malicious file, with the campaign beginning through sponsored search results for queries like "codex macos download."
Kaspersky researchers have identified the first malware specifically designed to target car head units, which has been enlisted into the BadBox botnet infrastructure. The discovery represents a significant expansion of botnet operations into automotive systems, with the malware already compromising millions of devices across the network.
Threat actors continue distributing WeedHack malware to Minecraft players through counterfeit game clients, maintaining operations even after law enforcement dismantled the malware's original infrastructure in July. The persistence of this campaign demonstrates how attackers adapt their distribution channels when primary infrastructure is disrupted, keeping a known threat active against gaming communities.
Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution appeared first on Unit 42.