Hackers compromised HBO Max's verified Reddit account and posted 108 malicious ads using ClickFix social engineering to distribute information-stealing malware to Windows and macOS users. The campaign, linked to a broader operation called PasteSwitch, tricked victims into pasting commands into their terminals to install fake applications, including counterfeit HBO Max apps and cryptocurrency wallets.
ClickFix attacks are deceiving Mac and Windows users through fake ads on Reddit, including a compromised HBO Max account, by displaying fake CAPTCHA prompts that trick users into pasting malware code into their terminal, instantly installing info-stealing malware that can access passwords and crypto wallets.