ClickFix attacks trick Mac and Windows users into installing malware

Key facts

• ClickFix attacks are a growing cybersecurity threat in 2026.
• The attacks trick users into installing info-stealing malware via terminal commands.
• A recent campaign used compromised HBO Max Reddit ads to lure victims.
• The malware can steal passwords, account access, and crypto wallets.
• The attacks evade antivirus by operating in the command prompt or terminal.
• Companies can block terminal access to prevent exploitation.

Cybersecurity researchers are warning of a sophisticated phishing technique dubbed "ClickFix" attacks that trick users into inadvertently installing malware on their Mac and Windows computers. These attacks have rapidly evolved and are becoming more frequent, posing a significant threat.

The method involves presenting users with fake websites or compromised legitimate sites that display messages resembling CAPTCHA or anti-bot verification checks. Upon clicking, users are instructed to copy and paste a string of text into their system's command prompt (Windows) or Terminal app (macOS). Executing this command instantly installs info-stealing malware, which can then access passwords, logged-in accounts, and cryptocurrency wallets. The use of the terminal bypasses many standard antivirus and security defenses because it allows direct interaction with the operating system.

A recent iteration of this campaign, identified by security researchers at Hudson Rock and discussed on Reddit's cybersecurity subreddit, involved hackers compromising an official HBO Max Reddit account. This compromised account was then used to post numerous convincing fake advertisements on Reddit, all leading to pages containing the ClickFix lure. The ads were designed to look like legitimate HBO Max promotions.

It remains unclear how many individuals were affected by this specific campaign. Warner Brothers Discovery, the parent company of HBO, did not immediately respond to a request for comment. Reddit confirmed that it had learned of the compromised HBO Max advertising account, had subsequently locked it, and removed the malicious ads. The company did not disclose the number of users targeted or who may have clicked the ads.

For corporate environments, security researcher Kevin Beaumont noted that companies managing fleets of Windows computers can implement domain-wide blocks on access to the Command Prompt or PowerShell to mitigate such attacks. Tools like BlockBlock are also available for Mac users to defend against similar self-inflicted security breaches.