# ClickFix

ClickFix is a social engineering technique that tricks users into executing malicious commands, often through fake CAPTCHAs or error messages.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## HBO Max's verified Reddit account hijacked to spread malware

DevFeed: [HBO Max's verified Reddit account hijacked to spread malware](<https://devfeed.tech/articles/hbo-max-s-verified-reddit-account-hijacked-to-spread-malware-26612.md>)

Original publisher: [Read original article](<https://www.malwarebytes.com/blog/news/2026/09/hbo-maxs-verified-reddit-account-hijacked-to-spread-malware>)

Author: Pieter Arntz

Published: 2026-09-15T11:51:03Z

Content type: news

Language: en

Sources: [Malwarebytes](<https://devfeed.tech/sources/malwarebytes.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [Reddit](<https://devfeed.tech/topics/reddit.md>), [Social engineering](<https://devfeed.tech/topics/social-engineering.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [Cryptocurrency](<https://devfeed.tech/topics/cryptocurrency.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [clickfix](<https://devfeed.tech/tags/clickfix.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [hbo-max](<https://devfeed.tech/tags/hbo-max.md>), [macos](<https://devfeed.tech/tags/macos.md>), [malware](<https://devfeed.tech/tags/malware.md>), [news](<https://devfeed.tech/tags/news.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [pasteswitch](<https://devfeed.tech/tags/pasteswitch.md>), [powershell](<https://devfeed.tech/tags/powershell.md>), [reddit](<https://devfeed.tech/tags/reddit.md>), [security](<https://devfeed.tech/tags/security.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [terminal](<https://devfeed.tech/tags/terminal.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

Cybercriminals hijacked HBO Max's verified Reddit account and used it to run 108 malicious ads over about 48 hours. The ads promoted fake software and used ClickFix-style instructions to distribute infostealers and cryptocurrency clipboard hijackers to macOS and Windows users.

### Source excerpt

Cybercriminals used HBO Max's verified Reddit account to run 108 malicious ads that tricked people into installing information stealers.

## HBO Max Reddit account compromised to serve ClickFix attacks

DevFeed: [HBO Max Reddit account compromised to serve ClickFix attacks](<https://devfeed.tech/articles/hbo-max-reddit-account-compromised-to-serve-clickfix-attacks-21627.md>)

Original publisher: [Read original article](<https://www.theregister.com/cyber-crime/2026/09/14/hbo-max-reddit-account-compromised-to-serve-clickfix-attacks/5296408>)

Author: Jessica Lyons

Published: 2026-09-14T22:43:01Z

Content type: news

Language: en

Sources: [www.theregister.com - Articles](<https://devfeed.tech/sources/www-theregister-com-articles.md>)

Topics: [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Reddit](<https://devfeed.tech/topics/reddit.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [clickfix](<https://devfeed.tech/tags/clickfix.md>), [cyber-crime](<https://devfeed.tech/tags/cyber-crime.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [hbo-max](<https://devfeed.tech/tags/hbo-max.md>), [macos](<https://devfeed.tech/tags/macos.md>), [malware](<https://devfeed.tech/tags/malware.md>), [reddit](<https://devfeed.tech/tags/reddit.md>), [security](<https://devfeed.tech/tags/security.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

The article reports that an HBO Max Reddit account was compromised and used to serve ClickFix attacks in a massive 48-hour malvertising campaign targeting macOS and Windows machines with malware.

### Source excerpt

Part of a 'massive 48-hour malvertising blitz' targeting macOS and Windows machines with malware

## ESET Threat Report H1 2026

DevFeed: [ESET Threat Report H1 2026](<https://devfeed.tech/articles/eset-threat-report-h1-2026-8365.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2026/>)

Author: Jiří Kropáč

Published: 2026-07-08T08:45:00Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [ESET research](<https://devfeed.tech/topics/eset-research.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Generative AI](<https://devfeed.tech/topics/generative-ai.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Android](<https://devfeed.tech/topics/android.md>), [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [QR Code](<https://devfeed.tech/topics/qrcode.md>), [ransomware](<https://devfeed.tech/topics/ransomware.md>), [Social engineering](<https://devfeed.tech/topics/social-engineering.md>), [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [android](<https://devfeed.tech/tags/android.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [code](<https://devfeed.tech/tags/code.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [generative-ai](<https://devfeed.tech/tags/generative-ai.md>), [malware](<https://devfeed.tech/tags/malware.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [research](<https://devfeed.tech/tags/research.md>), [security](<https://devfeed.tech/tags/security.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [threat-report](<https://devfeed.tech/tags/threat-report.md>)

### AI overview

ESET's H1 2026 threat report describes attackers adapting established techniques across new platforms and behaviors. It highlights the expanding abuse of AI skills, PromptSpy Android malware using Google Gemini, the spread of ClickFix and QR-code phishing, and continued ransomware activity involving EDR killers.

### Source excerpt

A view of the H1 2026 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts.

## Security Week 2609: новые варианты атак ClickFix

DevFeed: [Security Week 2609: новые варианты атак ClickFix](<https://devfeed.tech/articles/security-week-2609-clickfix-23057.md>)

Original publisher: [Read original article](<https://habr.com/ru/companies/kaspersky/articles/1002934/>)

Author: Kaspersky\_Lab ("Лаборатория Касперского")

Published: 2026-02-24T15:15:01Z

Content type: news

Language: ru

Sources: ["Лаборатория Касперского" RU](<https://devfeed.tech/sources/ru-2.md>)

Topics: [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [Security](<https://devfeed.tech/topics/security.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>)

Tags: [bitcoin](<https://devfeed.tech/tags/bitcoin.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [dns](<https://devfeed.tech/tags/dns.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [nslookup](<https://devfeed.tech/tags/nslookup.md>), [security](<https://devfeed.tech/tags/security.md>), [tag-9fe8963de219](<https://devfeed.tech/tags/tag-9fe8963de219.md>), [zip](<https://devfeed.tech/tags/zip.md>)

### AI overview

The article reviews two recent ClickFix attack studies. One variant uses nslookup to retrieve part of a malicious script from a controlled DNS server, downloads a ZIP archive, and installs ModeloRAT through VBS persistence. Another uses social engineering and JavaScript pasted into the Swapzone.io browser interface to replace Bitcoin wallet addresses and divert cryptocurrency.

### Source excerpt

На прошлой неделе опубликовано сразу два новых исследования об атаках типа ClickFix, в которых пользователя так или иначе мотивируют самостоятельно выполнять вредоносный код в командной строке. Команда Microsoft Threat Intelligence поделилась чуть более сложным, чем обычно, вариантом атаки, продемонстрированном на скриншоте ниже. Как правило, команда, которую злоумышленники заставляют запустить, содержит адрес, с которого загружается и выполняется вредоносный скрипт. Вероятно, для того чтобы усложнить детектирование атаки в корпоративном окружении и продлить жизнь вредоносной инфраструктуре, в этот простой сценарий вставлен еще один шаг: обращение к контролируемому DNS-серверу. От имени пользователя происходит обращение к DNS-серверу c использованием утилиты nslookup, запрашиваются данные для домена example.com. Из полученных в ответ данных выделяется строка NAME:, которая и содержит вторую часть вредоносного скрипта. Он, в свою очередь, напрямую скачивает ZIP-архив с набором вредоносных программ. На финальной стадии один из VBS-скриптов прописывается в автозапуск и на компьютер жертвы устанавливается троянская программа ModeloRAT. Это далеко не самый изощренный вариант атаки ClickFix. Ранее та же Microsoft сообщала о нетривиальной тактике, предусматривающей намеренное выведение из строя браузера путем установки вредоносного расширения под видом адблокера. Читать далее