Case fake-codex-google-sites-macos-malwareAI supply chainWorldwide
Fake Codex download pages on Google Sites deliver macOS malware via ClickFix
Fake Codex pages hosted on Google Sites, promoted via sponsored search and using ClickFix, target Mac users with malware.
MediumAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 14, 2026
- Location
- Worldwide
- Target
- macOS users seeking the Codex AI tool
- Severity
- Medium
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Fake Codex pages hosted on Google Sites, promoted via sponsored search and using ClickFix, target Mac users with malware.
Impact: Mac users who follow the instructions are infected with macOS malware; scale unknown.
Who triggered it
Actor: Unknown
Attribution: No attribution given in the summary.
Motive: Malware delivery (likely information theft)
How it happened
Attack vector: Fake Codex pages on Google Sites, sponsored search ads and ClickFix social engineering
Root cause: Impersonation of a popular AI coding tool's download page, plus abuse of ad and hosting platforms
Timeline
- Reported by Infosecurity Magazine
Response
Unknown
Current status: Ongoing
Sources (open in a new tab)
- Infosecurity Magazine infosecurity-magazine.com
Cite this case
Fake Codex download pages on Google Sites deliver macOS malware via ClickFix. AI Threat Watch, case fake-codex-google-sites-macos-malware, Oct 14, 2026. https://aithreat.io/cases/fake-codex-google-sites-macos-malware/
Permanent link: https://aithreat.io/cases/fake-codex-google-sites-macos-malware/