ClickFix exploits turn Reddit users into unwitting hackers
A surge in sophisticated ClickFix attacks has weaponized compromised corporate accounts on Reddit, tricking users into executing malicious code via their own system terminals. By masquerading as simple CAPTCHA prompts, these campaigns bypass traditional antivirus software, granting attackers immediate access to password databases, private accounts, and cryptocurrency wallets.
By Business Faces·September 15, 2026·2 min read·428 reads
The mechanics of the attack rely on social engineering rather than traditional software vulnerabilities. Victims encounter fake or compromised websites featuring a deceptive checkbox. Once interacted with, the site prompts the user to copy and paste a script directly into the Windows Command Prompt or macOS Terminal. Because this process originates from the user’s own inputs, security defenses often fail to flag the resulting installation of info-stealing malware as a threat.
Recent activity saw hackers seize the official HBO Max account on Reddit to distribute hundreds of fraudulent advertisements. Security researchers at Hudson Rock and community members on Reddit’s cybersecurity forums identified the campaign before it was neutralized. Reddit confirmed the account compromise, stating they have since locked the profile and purged the malicious links, though the platform declined to specify the total number of affected users. Warner Brothers Discovery has remained silent regarding the breach.
Defending against these tactics requires caution with terminal commands, a tool rarely intended for the average user. Security researcher Kevin Beaumont suggests that organizations managing large fleets of Windows devices can mitigate risk by restricting access to PowerShell and Command Prompt across their domains. For individuals, specialized tools like BlockBlock provide a layer of defense for macOS by monitoring attempts to manipulate system settings through terminal scripts.
Comments (0)
No comments yet. Be the first!