Crooks are stuffing fake OpenAI Codex ads into sponsored search results so developers click them and walk straight into a ClickFix malware trap. The payload is Mac malware. This is not some random junk popup. It is sitting at the top of search, dressed up like a tool a lot of people actually want.

OpenAI Codex is a coding assistant. Developers search for it, and the first thing they see is often a paid result. That paid result is the bait. One click later they are not on OpenAI. They are on a page built to make them infect their own Mac.

Sponsored search is the delivery truck

The scam does not need a clever exploit. It needs someone willing to buy the top of the page. Fake OpenAI Codex ads show up as sponsored results. Developers looking for the real product click the first link because that is how search has trained all of us to behave.

That is the part that pisses me off. Regular people, including folks who write software for a living, get used to ads sitting above everything else. Crooks know that. They rent that top slot and impersonate a brand people already trust.

ClickFix makes you install it yourself

ClickFix is a social engineering trick, not a magic bug that breaks Macs. The fake page tells you something needs a quick fix or a verification step. Then it wants you to copy a command and paste it into Terminal.

You do the work. The malware lands because you pasted it. Nobody had to hack your machine. That is why it still works on Macs that people treat like they are immune.

If a website is asking you to open Terminal and paste anything, you are not installing Codex. You are handing the keys over. Stop. Close the tab.

Why developers are the target

Developers search for command line tools, installers, and AI coding products all day. They live in Terminal. A fake Codex page that says it needs one extra step looks a lot like every other setup they already run.

That is the ugly part. The people who should catch this are also the people most used to pasting commands from a browser. Familiarity is the hole in the fence here, not stupidity.

What you should do instead

• Do not click sponsored results for OpenAI Codex, or for any developer tool. Go to the official site yourself.
• Type the real OpenAI site into the address bar. Do not trust the ad at the top of search.
• Never paste a command from a web page into Terminal just because a fix or verify prompt told you to.
• If you already clicked a fake Codex ad, do not run whatever it put on your clipboard. Clear it and close the page.
• Mac users are not magically safe. Treat unknown install steps the same way you would on a Windows box.

Big platforms will keep selling the ad slot. Crooks will keep impersonating the hot tool of the month. Your job is simple. Slow down, skip the sponsored link, and do not paste mystery commands into Terminal. That is how you keep your machine.

Primary Source: https://www.theregister.com/security/2026/08/25/crooks-push-mac-malware-through-fake-openai-codex-ads/5291899