From TechCrunch · Zack Whittaker · · 1m 40s
ClickFix ads turned Reddit users into their own attackers
A hijacked HBO Max ad account pushed fake CAPTCHA pages that talked people into pasting malware into their own terminal.
In brief
A hijacked HBO Max ad account pushed fake CAPTCHA pages that talked people into pasting malware into their own terminal. If a website ever tells you to copy a command into Terminal or Command Prompt to prove you are human, close the tab. That instruction is the attack. Originally reported by TechCrunch.
Check your Mac, now
Anyone who clicked an HBO Max ad on Reddit in the past week should scan their computer. The ads led to a page built to hand over control of the machine.
“If you clicked on an HBO Max ad on Reddit over the past week, you might want to check your computer for malware.”
A rare trick went industrial
ClickFix started small, picking off people googling quick tech fixes. In 2026 it scaled into an international campaign hitting far more machines, far more often.
“They have since evolved into a massive international effort to hack into people's computers.”
The fake CAPTCHA setup
A fake or hacked site shows what looks like an anti-bot checkbox. Click it and a prompt tells you to copy a string of text into Command Prompt or Terminal.
One keystroke, total loss
Hitting return installs an info-stealer instantly. It takes passwords, logged-in accounts and crypto wallets, and running through the terminal helps it slip past antivirus.
“many of these attacks evade antivirus and security defense tools”
Hundreds of ads from a real account
Hackers took over HBO Max's official Reddit advertising account and used it to post hundreds of convincing fake ads, according to Hudson Rock and Reddit's cybersecurity subreddit.
Nobody knows the damage
Reddit locked the account and pulled the ads, but would not say how many users were targeted or clicked. Warner Brothers Discovery did not respond to a request for comment.
“an HBO Max account authorized to run advertisements on Reddit was compromised”
How to shut the door
Developers use terminal one-liners; most people never should. IT teams can block Command Prompt and PowerShell domain-wide, and Mac users can run BlockBlock to catch the paste.
In short
If a website ever tells you to copy a command into Terminal or Command Prompt to prove you are human, close the tab. That instruction is the attack.
