Sponsored Google Ads for OpenAI Codex Lead to a Terminal Command That Installs Mac Malware. It Starts With a Real npm Install.
Cato Networks found a fake Codex download page running above the real results as a paid ad. There is no installer, only a command to paste, and the legitimate-looking first half is the entire trick.