ClickFix attacks are tricking Mac and Windows users into hacking themselves

Mac and Windows users are unwittingly installing malware on their devices after clicking on a deceptive message that appears to be a CAPTCHA or anti-bot checkbox, marking a surge in cybersecurity threats known as "ClickFix" attacks. These attacks, which have grown more frequent and sophisticated, entice users to copy and paste a malicious string of text into their computer's command prompt or terminal, thereby installing information-stealing malware that can hijack passwords, access logged-in accounts, and compromise crypto wallets.

The latest ClickFix campaign saw hackers infiltrating HBO Max's official account on Reddit, posting thousands of seemingly authentic ads to trick users into clicking on malicious links. The compromised Reddit account was used to display fake ads resembling HBO Max, which contained the ClickFix lure. It remains unclear how many people fell victim to these deceptive ads or how many devices were ultimately compromised.

Hudson Rock's security researchers attributed the attack to hackers posting fraudulent ads on Reddit, linking to a page that mirrors HBO Max but has a hidden ClickFix lure. Warner Brothers Discovery, the parent company of HBO, declined to comment on the matter, while Reddit acknowledged learning about the compromised account and removed the malicious ads after TechCrunch reached out for comment.

The number of users targeted or affected remains undisclosed by both Warner Brothers Discovery and Reddit. Companies can prevent such attacks by blocking access to command prompts or terminals in Windows and macOS, as suggested by security researcher Kevin Beaumont. Mac users can also utilize BlockBlock to defend against such attacks.