A verified HBO Max advertising account on Reddit was reportedly compromised and used to spread malicious advertisements designed to trick users into installing malware through a technique known as ClickFix.
According to reports, attackers published 108 malicious ads over roughly 48 hours. The ads promoted what appeared to be HBO Max downloads and other software and AI-related tools, directing users to fake websites designed to look legitimate.
Instead of offering a genuine download, the websites instructed visitors to open system tools such as Terminal on Mac or PowerShell and the Run dialog on Windows, paste a command and execute it.
This is the key feature of a ClickFix attack. Rather than silently installing malware, attackers manipulate users into running the malicious command themselves.
Depending on the campaign, these commands can install information-stealing malware capable of collecting saved passwords, browser data, account credentials and cryptocurrency wallet information.
Reddit reportedly confirmed that an HBO Max account authorised to run advertisements had been compromised. The platform said it locked the account and removed the malicious ads. It remains unclear how many users clicked the advertisements or were ultimately affected.
ClickFix is not a new technique. McAfee researchers documented similar attacks in 2024 involving compromised websites that displayed fake error messages and instructed users to paste scripts into PowerShell. Those campaigns were linked to malware including DarkGate and Lumma Stealer.
Researchers later observed the same technique being disguised as fake CAPTCHA verification pages. Users were told to prove they were human, but clicking the verification button could copy a malicious command to the clipboard. The victim was then instructed to open the Windows Run box, paste the command and execute it.
Similar ClickFix-style attacks have also appeared in social media videos promoting free software upgrades and premium versions of popular applications.
The latest campaign shows how the same social engineering technique can be adapted to different platforms and trusted brands. A verified account or familiar company name does not necessarily make an advertisement or download safe.
The biggest warning sign is a website asking users to copy and paste an unexplained command into Terminal, PowerShell, Command Prompt or the Windows Run box. Ordinary software downloads and CAPTCHA checks should not require users to execute commands they do not understand.
Users should avoid downloading software through suspicious advertisements and instead visit the software company’s official website or a trusted app store directly. Keeping devices and security software updated and enabling multifactor authentication can also reduce the risk of compromise.
The basic rule is simple: if a webpage asks you to copy, paste and run a command on your computer, stop and verify it before doing anything. In a ClickFix attack, the “fix” can be the malware itself.
