If you clicked on an HBO Max ad on Reddit in the past week or so, you should check your computer for malware. Not because of a software vulnerability, not because of a zero-day exploit, but because someone may have talked you into infecting yourself. That’s the whole point of ClickFix attacks, and they’re working.
As reported by TechCrunch, security researchers at Hudson Rock identified a recent campaign in which hackers compromised HBO Max’s official Reddit account and used it to post hundreds of convincing fake advertisements. Those ads linked to a page designed to look like HBO Max, which then displayed what appeared to be a CAPTCHA or anti-bot verification prompt. Click it, and you get instructions to copy a string of text and paste it into your Windows Command Prompt or Mac Terminal. Hit return, and you’ve just installed info-stealing malware on your own machine.
Reddit confirmed it “recently learned that an HBO Max account authorized to run advertisements on Reddit was compromised and used to run ads containing malicious links.” The company locked the account and pulled the ads. Warner Bros. Discovery, which owns HBO, did not respond to a request for comment. Reddit also declined to say how many users clicked on those ads, which is exactly the kind of transparency gap that should frustrate anyone asking the obvious question: how bad was the damage?
The reason ClickFix attacks are so effective is almost elegant in its cynicism. Because the user is the one running the command in the terminal, many antivirus tools never trigger. The malware doesn’t arrive through a suspicious download or an email attachment. It arrives because you typed it in yourself. Security defenses are largely built around flagging external threats. This approach makes the user the threat vector.
Once executed, this kind of malware can steal passwords, hijack logged-in accounts, and drain crypto wallets. Fast. And until recently, ClickFix was a fairly niche technique targeting people searching for tech support online. Now it’s showing up in paid ad slots on one of the most visited sites on the internet. That’s a significant shift in scale and ambition.
There are a few practical defenses worth knowing about:
- Companies managing Windows fleets can block access to Command Prompt and PowerShell across all devices through domain policy settings.
- Mac users can install BlockBlock, a free tool that alerts you when something tries to establish persistence on your system.
- Anyone who isn’t a developer has almost no legitimate reason to paste code into a terminal after clicking an ad. That alone should be a hard stop.
The broader trend here is social engineering replacing technical exploits as the preferred attack method. It’s cheaper, it scales, and it works. And when attackers can buy or hijack verified ad accounts on major platforms to run their lures, the usual advice, “just don’t click sketchy links,” starts to feel a little hollow.