Hijacked HBO Max Reddit Ads Pushed ClickFix Malware to Windows and Mac Users
Attackers took over an HBO Max account allowed to run ads on Reddit and used it to post hundreds of fake ads linking to a copycat HBO Max page with a ClickFix trap meant to get users to infect their own computers. Security researchers at Hudson Rock spotted the campaign, according to TechCrunch reporting published September 14, 2026. Reddit told TechCrunch that an HBO Max account authorized to run advertisements was compromised and used to run ads with malicious links. Reddit said it locked that advertising account and removed the malicious ads.
The fake HBO Max page showed a ClickFix prompt, typically a fake CAPTCHA or anti-bot checkbox (the test used to check you are human), that told visitors to copy and paste text into Windows Command Prompt or Mac Terminal (the built-in programs that run typed commands). That pasted command fetched and ran info-stealing malware. In this campaign, the payload was described as capable of stealing passwords, logged-in account access, and crypto wallets.
The user does the work. No software flaw is needed. The operating system sees an approved user running an approved tool, which is why ClickFix works across Windows and macOS and why endpoint controls tuned for drive-by exploits (infections from just visiting a page) or malicious attachments often see nothing to block until the infostealer runs.
That cross-platform reach is not new. Microsoft researchers observed an infostealer campaign using ClickFix-style instructions with fake macOS utilities lures, reported May 6, 2026, according to Microsoft. Malwarebytes reported on July 3, 2026 a campaign that used a verified X ad to spread Mac malware to Mac users, alongside a separate technique it called ConsentFix for stealing Microsoft accounts, according to Malwarebytes. Ars Technica reported September 11, 2026 that ClickFix attacks infecting PCs and Macs have gone from exotic to mainstream, according to Ars Technica.
Reddit ads from a compromised brand account carry both platform trust and brand trust at once. A user scrolling Reddit sees the HBO Max name, the authorized advertiser badge, and ad creative that matches expectations for a streaming promotion. The click leads off-platform to a lookalike domain, but the decision to trust was already made on-platform.
The broader context here is a change in the costs of breaking in. Social engineering that turns the victim into the installer avoids the cost of finding and weaponizing a software flaw and avoids the signals that come with it. Copy and paste into Terminal or Command Prompt is normal administrator behavior, it is used in legitimate developer work, and it leaves little early warning for mail gateways or web filters still looking for malicious files. For defenders, that narrows detection to post-click address checks and post-run behavior, both of which are noisy at scale.
In my view, the lasting fix is not another warning box about CAPTCHAs. Enterprise teams can limit use of command tools, enforce application allowlisting (only approved software can run), require signed installers for managed Macs, and quickly revoke login tokens when infostealer activity is suspected. Consumers have fewer options, which puts weight on ad platforms to catch unusual advertiser behavior, such as a dormant or newly compromised brand account suddenly publishing hundreds of ads pointing to newly registered copycat sites, and to pause that activity before delivery. The pattern rewards faster shutdown of stolen advertiser sessions and tighter links between advertiser identity, payment method, and destination address.
The opportunity that follows is to treat commands typed or pasted by users with the same caution long applied to attachments users open, and to add friction at the one step the attacker cannot skip. Copy, paste, and enter remain the universal installer. If that step gets harder to abuse, this kind of packaged trust becomes much less useful.
