Observed Signal · Sep 14, 2026 · Security Incident · Source: techcrunch · Impact: 4/5 · Sentiment: Negative
Cybersecurity Market: ClickFix Attacks Trick Mac and Windows Users via Reddit Ads
A new wave of 'ClickFix' cyberattacks is targeting Mac and Windows users through fake advertisements on Reddit. Hackers compromised an official HBO Max account authorized to run ads on Reddit, using it to post malicious adverts that linked to a fake HBO Max page. The page displayed a fake CAPTCHA, instructing users to copy and paste a malicious command into their Terminal (Mac) or Command Prompt (Windows). This action installs info-stealing malware that can exfiltrate passwords, session cookies, and crypto wallets. Security firm Hudson Rock reported on the campaign, and Reddit has since locked the compromised account and removed the malicious ads, though the number of affected users remains unclear. The attack exploits user trust in legitimate brands and the power of terminal commands.
This incident highlights a novel, sophisticated technique (ClickFix) spreading through a trusted advertising channel (Reddit), leveraging a compromised official account of a major brand (HBO Max). It poses a direct threat to users of a major social platform and could undermine trust in digital advertising. The widespread adoption potential makes it highly relevant to the AdTech industry's security landscape.
Key Takeaways & Evidence Grounding
- ClickFix attacks involve fake CAPTCHAs that trick users into running malicious terminal commands.
- Hackers compromised a Reddit account authorized to run HBO Max ads to distribute malicious links.
- The attacks target both macOS and Windows systems, evading some antivirus tools.
- Reddit locked the compromised account and removed the ads, but impact numbers are undisclosed.
- Security researchers highlight measures like blocking terminal access and using tools like BlockBlock for Mac.
Connected Companies & Entities
2 Entities mappedWarner Bros. Discovery
Global media owner spanning streaming, studios, publishing, gaming and ad sales.
“Warner Brothers Discovery, which owns HBO, did not respond to a request for comment....”
Social platform monetised through community advertising and data licensing.
“Reddit told TechCrunch it 'recently learned that an HBO Max account authorized to run advertisements on Reddit was compromised and used to r...”
Ontology Mapping & Concepts
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.