A compromised HBO Max advertising account on Reddit was used to distribute malicious ads designed to trick users into installing information-stealing malware on their own computers. The campaign used a technique known as ClickFix, which disguises malicious commands as verification steps and relies on users manually running them through Windows or macOS command-line tools.
Reddit confirmed that an HBO Max account authorized to run advertisements on the platform had been compromised and used to distribute ads containing malicious links. The company said it locked the account and removed the ads, but has not disclosed how many users saw, clicked or interacted with them.
ClickFix Tricks Users Into Running Malware Themselves
ClickFix attacks typically direct victims to fake or compromised websites displaying something resembling a CAPTCHA or anti-bot check. Users are then instructed to copy a supplied command and paste it into Windows Command Prompt, PowerShell or the macOS Terminal.
Running that command can immediately install information-stealing malware capable of collecting passwords, authenticated browser sessions and cryptocurrency wallet information. Because the victim manually executes commands through an operating system tool, some ClickFix campaigns can bypass defenses that would normally block automatically downloaded malware.
The HBO Max campaign was identified by researchers at Hudson Rock, who said attackers gained access to the legitimate advertising account and used it to publish hundreds of convincing ads. Clicking those ads could direct users to a page designed to resemble HBO Max before presenting the malicious verification instructions.
Researchers and Reddit users also documented the campaign in the site’s cybersecurity community. Warner Bros. Discovery, HBO’s parent company, did not respond to a request for comment.
ClickFix Campaigns Expand Beyond Fake Support Pages
ClickFix was previously associated more commonly with fake troubleshooting pages and search results offering supposed fixes for technical problems. Attackers have since expanded the technique to advertising networks, compromised websites and other distribution channels capable of reaching larger numbers of users.
Organizations managing Windows computers can reduce exposure by restricting access to PowerShell, Command Prompt and similar tools for employees who do not need them. Security researcher Kevin Beaumont has recommended such controls where practical because ClickFix depends heavily on persuading victims to execute commands themselves.
Mac users can also use security tools designed to detect persistent software installation. Objective-See’s free BlockBlock monitors macOS for software attempting to establish persistence, providing another layer of protection against malware delivered through techniques such as ClickFix.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.