Attacking Multimodal OS Agents with Malicious Image Patches