HACKERS PLACE FAKE CODEX DOWNLOAD ABOVE LEGITIMATE OPENAI RESULT TO INFECT MAC USERS

Summary from the TLDR InfoSec newsletter

Threat actors are leveraging sponsored Google Search ads to position fake OpenAI Codex download pages above legitimate results. The campaign utilizes a ClickFix-style social engineering trick to convince macOS users to paste a malicious Terminal command that decodes a Base64 URL, strips quarantine attributes using xattr -c, and drops a universal Mach-O payload linked to Atomic macOS Stealer (AMOS) infrastructure. Security teams should proactively block associated domains like brightlinks[.]com and configure SIEM alerts for any curl-to-zsh pipelines paired with xattr -c execution.