ClickFix attacks trick users into self-installing malware
Original: ClickFix attacks are tricking Mac and Windows users into hacking themselves
Why This Matters
ClickFix sidesteps endpoint security by weaponizing users' own terminal access — a gap most enterprise defenses don't cover.
Hackers compromised HBO Max's official Reddit account to post fake ads linking to ClickFix lure pages. Users tricked into pasting terminal commands instantly install info-stealing malware, bypassing antivirus tools on both Windows and macOS. Reddit locked the account and removed the ads; victim count is unknown.
ClickFix attacks have become one of 2026's fastest-growing cybersecurity threats. The method is deceptively simple: fake or compromised websites display what looks like a CAPTCHA or anti-bot checkbox. After clicking, users are instructed to copy and paste a text string into Windows Command Prompt, PowerShell, or macOS Terminal. Hitting return immediately installs info-stealing malware capable of harvesting passwords, session cookies, and crypto wallet credentials. Because the attack runs through the terminal — a direct line to the OS — most antivirus tools miss it entirely.
The latest campaign escalated the technique considerably. Hackers seized HBO Max's official Reddit advertiser account and used it to post hundreds of realistic-looking ads pointing to a spoofed HBO Max page loaded with a ClickFix lure. Security researchers at Hudson Rock flagged the campaign, which was also discussed in Reddit's cybersecurity subreddit. Reddit confirmed it "recently learned that an HBO Max account authorized to run advertisements on Reddit was compromised" and said it locked the account and pulled the ads. Warner Bros. Discovery did not respond to comment requests, and Reddit declined to share how many users were targeted or clicked the malicious links.
Defenses exist but require proactive steps. Enterprise IT teams can block terminal access across Windows domains. Security researcher Kevin Beaumont recommends that approach for organizations. Mac users have the tool BlockBlock as an additional layer of protection.