ClickFix malware scheme spreads through compromised Reddit ads
Cybersecurity researchers warn of a surge in ClickFix attacks, where fake CAPTCHA prompts trick users into running malicious commands in their terminal. The latest campaign involved a compromised HBO Max advertising account on Reddit, which posted fake ads linking to a malicious page. Victims unknowingly install info-stealing malware that can capture passwords and crypto wallets.
The ClickFix technique exploits a common trust in CAPTCHA verification systems. When users encounter the fake prompt, they are instructed to copy a text string into their system's command interface, a process that appears routine but actually executes the malware installation. Because the user initiates the command themselves, traditional security software often fails to flag the activity as suspicious.
The Reddit campaign specifically targeted the streaming service's official advertising account, which had been compromised by hackers. The malicious ads directed users to a convincing HBO Max lookalike page. Reddit has since locked the compromised account and purged the fraudulent advertisements, though the company has not disclosed how many users may have encountered or clicked on them.
ClickFix attacks represent a growing threat because they bypass traditional security measures by making victims execute the malicious code themselves. This campaign could affect Reddit users who clicked the fake HBO Max ads, potentially exposing their passwords, financial accounts, and cryptocurrency holdings. The compromise of an official advertising account may also erode trust in platform advertising, as users may become more cautious about clicking legitimate ads. Organizations may need to implement stricter controls on terminal access to mitigate this evolving attack vector.