# ClickFix ads turned Reddit users into their own attackers

> A hijacked HBO Max ad account pushed fake CAPTCHA pages that talked people into pasting malware into their own terminal.
- Title: ClickFix ads turned Reddit users into their own attackers
- Summary: A hijacked HBO Max ad account pushed fake CAPTCHA pages that talked people into pasting malware into their own terminal. If a website ever tells you to copy…
- Keywords: clickfix, malware, reddit, infostealer, security, technology, startups, ads, turned, users, own, attackers
- Source: TechCrunch — https://techcrunch.com/2026/09/14/clickfix-attacks-are-tricking-mac-and-windows-users-into-hacking-themselves
- Author: Zack Whittaker
- Published: 2026-09-14T18:08:43+00:00
- Read time: 1 min
- Topics: clickfix, malware, reddit, infostealer, security, technology, startups
## Check your Mac, now
Anyone who clicked an HBO Max ad on Reddit in the past week should scan their computer. The ads led to a page built to hand over control of the machine.

> If you clicked on an HBO Max ad on Reddit over the past week, you might want to check your computer for malware.
## A rare trick went industrial
ClickFix started small, picking off people googling quick tech fixes. In 2026 it scaled into an international campaign hitting far more machines, far more often.

> They have since evolved into a massive international effort to hack into people's computers.
## The fake CAPTCHA setup
A fake or hacked site shows what looks like an anti-bot checkbox. Click it and a prompt tells you to copy a string of text into Command Prompt or Terminal.
## One keystroke, total loss
Hitting return installs an info-stealer instantly. It takes passwords, logged-in accounts and crypto wallets, and running through the terminal helps it slip past antivirus.

> many of these attacks evade antivirus and security defense tools
## Hundreds of ads from a real account
Hackers took over HBO Max's official Reddit advertising account and used it to post hundreds of convincing fake ads, according to Hudson Rock and Reddit's cybersecurity subreddit.
## Nobody knows the damage
Reddit locked the account and pulled the ads, but would not say how many users were targeted or clicked. Warner Brothers Discovery did not respond to a request for comment.

> an HBO Max account authorized to run advertisements on Reddit was compromised
## How to shut the door
Developers use terminal one-liners; most people never should. IT teams can block Command Prompt and PowerShell domain-wide, and Mac users can run BlockBlock to catch the paste.
## Key takeaway

If a website ever tells you to copy a command into Terminal or Command Prompt to prove you are human, close the tab. That instruction is the attack.