🚨 This one's nasty.
Googled "codex macbook download" — first result is a sponsored ad pointing to https://t.co/Va0KxtCRfJ. The real domain.
It opens a shared ChatGPT chat with friendly install steps: open Terminal, paste this command.
That command hides a base64 string. Decoded 👇
curl to trekmesh15[.]com — a known ClickFix domain dropping MacSync Stealer. Passwords, keychain, crypto wallets. Gone.
So the infection chain is: Google Ad → legit https://t.co/Va0KxtCRfJ share link → you infect yourself.
No exploit. No download. Just trust in a Google ad and a ChatGPT page.
Don't ever paste Terminal commands from an ad or a shared chat. Tell your Mac friends.