57
57
42
42
42
ClickFix attacks infecting PCs and Macs are going viral
ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.
BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.
62
42
57
42
57
42
42
57
42
57
42
Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads
Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.
HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.
63
HBO Max Reddit Account Hijacked to Spread PasteSwitch ClickFix Malware
Hijacked HBO Max verified Reddit account ran 108 ClickFix malvertising ads delivering AMOS and Amatera stealers plus crypto clippers to macOS and Windows users.
Threat actors hijacked HBO Max's verified Reddit account (u/hbomax) to run 108 malicious ClickFix ads over 48 hours in a campaign tracked as PasteSwitch, researched by Hudson Rock and ADAMnetworks. macOS victims were served curl | zsh chains deploying MacSync and Atomic macOS Stealer (AMOS), which harvest browser credentials, Telegram data, Apple Notes, and macOS passwords, while fake Ledger, Trezor, and Exodus apps targeted BIP39 seed phrases. Windows users received an InstallFix chain using an MP3/HTA polyglot with mshta and PowerShell, scheduled-task persistence, AMSI disabling, and in-memory Amatera Stealer that hid C2 traffic (77.91.65.13:443) behind a facebook.com TLS SNI. AnimateClipper and ZigClipper components swapped copied crypto wallet addresses and used Binance Smart Chain contracts as mutable C2 dead drops; Reddit paused the ads and the initial access path remains undisclosed.
68
ClickFix attacks are tricking Mac and Windows users into hacking themselves
ClickFix campaigns trick users into pasting terminal commands via fake CAPTCHAs; latest wave abused HBO Max's hacked Reddit account to push infostealer ads.
ClickFix attacks use fake CAPTCHA or anti-bot prompts on hacked or counterfeit websites to convince victims to copy a command into Windows Command Prompt or macOS Terminal, instantly installing infostealers that steal passwords, logged-in sessions, and crypto wallets. The latest campaign compromised HBO Max's official Reddit account to post hundreds of fake ads linking to a spoofed HBO Max page carrying the lure, per researchers at Hudson Rock. It is unclear how many users were compromised. Because execution happens in the terminal, many attacks evade antivirus tools; enterprises can block terminals domain-wide and Mac users can deploy BlockBlock.
68
42
57
42
42
Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack
Attackers hijacked HBO Max's verified Reddit account to push 108 malicious ads delivering AMOS and Amatera infostealers via ClickFix prompts.
Threat actors compromised the official u/hbomax Reddit account and ran 108 malicious ads over 48 hours in a campaign tracked as PasteSwitch, directing users to a fake hbomaxx[.]us site. ClickFix prompts tricked macOS users into running curl | zsh payloads (MacSync, AMOS Helper, fake wallets) and Windows users into executing MSHTA/PowerShell delivering Amatera Stealer. AnimateClipper and ZigClipper clipboard hijackers swapped cryptocurrency addresses using a blockchain-hosted C&C active since early 2026. Reddit suspended the ads after notification.
58
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads
Hackers hijacked HBO Max's verified Reddit account to run 108 ClickFix ads delivering infostealers and crypto clippers to Windows and macOS users.
Hudson Rock and ADAMnetworks linked the hijacked u/hbomax Reddit account to a campaign they call PasteSwitch, which ran 108 malicious ads over roughly 48 hours pushing sites like hbomaxx.us, codex-craft.com, and code-desktop.com. ClickFix social engineering tricks victims into pasting Base64-obfuscated shell or PowerShell commands into Terminal or Run, delivering MacSync, AMOS helper persistence, Amatera Stealer loaded in-memory, and the AnimateClipper and ZigClipper crypto clipboard hijackers. Windows chains used an MP3/HTA polyglot to create scheduled tasks, disable AMSI, and launch 32-bit PowerShell; fake Ledger, Trezor Suite, and Exodus wallet apps steal recovery phrases. Reddit admins paused the ads, and it remains unclear how the account was accessed.
62
57
42
42
42
42
42
42
42
42
HBO Max’s verified Reddit account hijacked to spread malware
Cybercriminals hijacked HBO Max's verified Reddit account to run 108 ClickFix ads pushing AMOS and Amatera infostealers via fake HBO app sites.
Hudson Rock found that hijackers used HBO Max's verified Reddit account to run 108 malicious ads over roughly 48 hours promoting fake AI tools and macOS utilities. The ads led to HBO lookalike sites instructing victims to paste commands into Terminal or PowerShell, a ClickFix social-engineering technique ADAMnetworks dubbed PasteSwitch. macOS payloads included MacSync and AMOS infostealers targeting browser credentials, Telegram data, Apple Notes, passwords, and crypto recovery phrases; Windows users received the in-memory Amatera infostealer. The operation is also linked to cryptocurrency clipboard hijackers, and Reddit admins paused the ads and opened an investigation.
62
42
42
47
42
60