A sponsored post on Reddit promising a free stream of HBO Max. A page that loads with a convincing "verify you are human" prompt. A few keystrokes later, malware is running on the victim's own machine — and the attacker never had to exploit a single software vulnerability. This is the ClickFix attack, a social engineering technique that has quietly become one of the most effective ways to compromise both Mac and Windows systems.
The FBI's Internet Crime Complaint Center logged more than 880,000 complaints in 2023, with losses exceeding $12.5 billion, and social engineering remains the primary entry point for the majority of breaches. Verizon's Data Breach Investigations Report has consistently found that roughly three-quarters of breaches involve a human element, and IBM's X-Force Threat Intelligence Index shows phishing and social engineering activity rising year over year. ClickFix is the latest evolution of that trend: it doesn't need a zero-day. It just needs you to follow directions.
What Is ClickFix and Why Is It Spreading Fast
The core of a ClickFix attack has existed in some form for years, but security researchers began tracking it under that name in 2024 after a wave of campaigns that abused fake CAPTCHA pages and browser error prompts. Rather than tricking a user into downloading a malicious file — a step browsers and antivirus tools increasingly flag — the attacker convinces the victim to paste and run a command themselves. Researchers at Proofpoint and Malwarebytes have documented the technique spreading across hundreds of compromised or newly registered domains, often using legitimate cloud infrastructure to appear trustworthy.
Three factors explain the rapid growth. First, it bypasses traditional defenses. The payload arrives through the operating system's own built-in tools, such as PowerShell on Windows or Terminal on macOS, which are trusted by default. Second, the instructions are simple: copy this text, paste it here, press Enter. There is no malware attachment to scan and no suspicious installer to click through. Third, the attack depends only on social engineering, which scales cheaply. A single campaign can target tens of thousands of visitors with minimal infrastructure.
CrowdStrike and other threat intelligence firms have noted that these campaigns share code and tactics across financially motivated crime groups, which accelerates their spread. When one crew finds a landing page layout that converts, others copy it within days.
The Reddit HBO Max Ad Campaign: A Real-World Example
On September 14, 2026, TechCrunch reported that a fake HBO Max advertising campaign on Reddit had pushed ClickFix attacks on Mac and Windows users over the preceding week. The setup was straightforward: an ad that looked like a legitimate streaming promotion, promising cheap or free access to HBO Max content. Users who clicked through landed on a page designed to mimic a browser verification screen, at which point the ClickFix flow began.
Read next Top Technology Trends in 2026 You Need to KnowReddit is an attractive distribution channel for this style of attack because its ad system lets malicious actors place sponsored content in front of broad audiences before moderation catches it. The platform's users skew tech-savvy, but that is no protection — a streaming offer presented inside a feed of entertainment discussion looks unremarkable. The reported campaign is a reminder that social engineering targets interest, not ignorance.
Because the exact scope of the Reddit campaign has not been fully detailed publicly, the important takeaway is the pattern rather than a specific victim count. An ad network, a streaming brand, and a familiar verification screen are all it takes to move a victim from curiosity to compromise in under a minute.
How ClickFix Tricks You Into Infecting Your Own Device
The mechanism behind a ClickFix attack is sometimes called "self-XSS disguised as troubleshooting." The victim believes they are completing a routine security check. In reality, they are the execution vector.
A typical sequence looks like this. The landing page displays a fake CAPTCHA or a browser update prompt claiming something is broken. It instructs the user to press a keyboard shortcut to open a developer console or a system dialog. Text that appears to be a verification code is copied to the clipboard automatically, or the user is told to copy it from the page. The victim pastes that text into the prompt and presses Enter. The pasted command then retrieves and runs a loader from a remote server, which in turn installs infostealer malware, a remote access trojan, or an initial foothold for ransomware.
On Windows, the command often abuses PowerShell. On macOS, it uses Terminal commands, sometimes invoking curl or other built-in utilities that require no additional software. Malwarebytes researchers have described how these pages often mimic legitimate verification providers closely enough to fool attentive users, with correct branding, loading animations, and instructions that feel official.
The critical insight is that the victim retains control the entire time. There is no exploited bug. There is only a decision — made under mild time pressure and visual deception — to run a command supplied by a stranger.
Who Is at Risk: Mac and Windows Users Alike
For years, Mac users operated under the comfortable assumption that malware was a Windows problem. That assumption has been eroding for a decade. Malwarebytes' annual State of Malware reports have documented macOS detections rising sharply, and Apple's own platform security guides acknowledge that user-initiated execution of malicious code remains a viable threat. The ClickFix model is platform-agnostic by design: it targets the person, not the operating system.
Windows users face a larger historical base of commodity malware, but macOS users may actually be more exposed in one respect. Many are less practiced at recognizing suspicious command-line instructions, and fewer run third-party endpoint protection by default. When a ClickFix page tells a Mac user to open Terminal and paste a "verification command," the unfamiliarity of the request can make it seem more authoritative rather than less.
Windows and macOS also share the underlying problem: both ship with powerful scripting and command-line utilities that are essential to normal operation. You cannot simply remove PowerShell or Terminal without breaking the machine. That design reality means ClickFix will remain effective for as long as users can be persuaded to run commands they do not understand.
How to Recognize and Avoid ClickFix Attacks
The single most reliable rule for stopping a ClickFix attack is simple: legitimate websites never ask you to open Terminal, PowerShell, or the Run dialog to verify that you are human. No CAPTCHA, no age check, no streaming service, and no software update requires you to paste a command into a system prompt. If a page instructs you to do so, close the tab.
Several other signals are worth memorizing. Distrust any page reached through an advertisement, especially on social platforms and forums, where ad review is imperfect. Be skeptical of free or heavily discounted offers for paid services; the offer is the bait. Watch for pages that auto-copy text to your clipboard — that behavior is abnormal and often a sign the site wants to place a malicious command where you can easily paste it. Browser security warnings about "unusual activity" are almost always fabricated when they appear on a random webpage.
If you have an IT department, report the page. If you don't, consider running reputable endpoint protection that includes behavioral detection, since signature-based tools alone will miss commands run through trusted system utilities.
What to Do If You Think You've Been Compromised
Act quickly, and act in the right order. Disconnect the device from the internet first, which limits a remote attacker's ability to pull data or issue further commands. If you remember what you pasted, do not paste it again, and do not run it anywhere for inspection — assume it was malicious.
Next, examine what the command may have installed. Infostealers typically look for saved browser passwords, session cookies, crypto wallets, and authentication tokens. From a separate, trusted device, change the passwords for your most important accounts — email first, then banking, then everything tied to those accounts — and revoke active sessions so stolen tokens stop working. Enable multi-factor authentication using an app or hardware key rather than SMS.
Then decide whether to clean or rebuild. For a device that ran an unknown command, a full operating system reinstall from known-good media is the only way to be confident the system is clean; antimalware scans can miss persistent loaders. On macOS, that means erasing the drive and reinstalling. On Windows, it means a clean install rather than a reset that preserves files.
Finally, report the incident. In the United States, that means the FBI's Internet Crime Complaint Center; many other countries have equivalent national cybercrime reporting bodies. Reporting helps investigators map campaigns like the Reddit HBO Max ads and take down the infrastructure behind them — which is, in the end, the only way the next person avoids the trap.
Source: TechCrunch
