Reddit HBO Max Ad Hack: ClickFix Attacks Trick Users Into Installing Malware

How the ClickFix attack works

ClickFix attacks use social engineering, not software flaws, to trick people into infecting their own computers. The attacker sets up a fake website or compromises a legitimate one. The site displays a message that looks like a CAPTCHA or a technical problem, then offers a 'fix'. The user is told to copy a command and paste it into their computer's Terminal (on Mac) or Command Prompt (on Windows). When they do this, they unknowingly install malware themselves. There is no exploit, no file to download, and no obvious warning from security tools, because the user is running the command directly (TechCrunch↗ (opens in a new tab), The Hacker News↗ (opens in a new tab)).

The Reddit HBO Max incident

In mid-September 2026, attackers compromised the official HBO Max account on Reddit. Over 48 hours, they posted 108 fake adverts targeting both Mac and Windows users. The ads linked to a site mimicking HBO Max, which prompted visitors to download an app (which does not exist for Mac) or to run a command in Terminal or Command Prompt. This installed info-stealing malware, including MacSync, AMOS Helper, and Amatera Stealer, which can steal passwords, browser data, and cryptocurrency wallets (SecurityWeek↗ (opens in a new tab), The Hacker News↗ (opens in a new tab)).

Reddit confirmed the HBO Max account was compromised and used for malicious ads, and said it locked the account and removed the ads. The number of affected users is not known. Warner Bros. Discovery, which owns HBO Max, did not comment (TechCrunch↗ (opens in a new tab)).

Scale and evolution of ClickFix attacks

ClickFix has grown from a rare trick to one of the most common ways attackers gain access to enterprise and personal devices. Microsoft attributed 47% of initial-access cases handled by its Defender Experts team in 2025 to ClickFix, ahead of traditional phishing. ESET measured a 517% rise in ClickFix attacks into the first half of 2025, and another 108% increase into 2026. The technique now has its own entry in the MITRE ATT&CK framework (T1204.004: User Execution - Malicious Copy and Paste) (The Hacker News↗ (opens in a new tab)).

Attackers use a variety of lures: fake support pages, fake Cloudflare verification, and even fake software downloads for popular apps like Spotify, Zoom, and Microsoft Teams. Some campaigns use blockchain technology (Polygon smart contracts) to rotate their infrastructure, making takedown and blocking difficult. The malware delivered can include remote access trojans (RATs) like ChainScript, info-stealers, and cryptocurrency clippers (The Hacker News↗ (opens in a new tab)).

Defending against ClickFix

Because ClickFix relies on tricking the user, traditional antivirus and URL blocking are often ineffective. The attack does not rely on a software vulnerability or a suspicious file download. Instead, it abuses the trust users have in their own system tools. Security experts recommend:

• Training users not to run commands from untrusted sources.
• Blocking access to Terminal or Command Prompt for users who do not need it, especially in enterprise environments.
• Using endpoint protection tools that monitor for suspicious command-line activity.
• For Mac users, tools like BlockBlock can help detect and block malicious persistence.

What to do if you think you are affected

If you have copied and run a command from a suspicious website, especially one claiming to fix a technical problem, you should:

• Disconnect from the internet.
• Run a full malware scan with a reputable security tool.
• Change passwords, especially for sensitive accounts.
• Consider restoring your system from a backup made before the incident.

The bigger picture

ClickFix attacks show that attackers do not always need to find a technical vulnerability. By manipulating people into running commands themselves, they can bypass many traditional defences. This makes user awareness and system restrictions more important than ever.