ClickFix attacks are tricking Mac and Windows users into installing malware
A new wave of cybersecurity threats known as ClickFix attacks has been targeting both Mac and Windows users by deceiving them into self-installing malware. These attacks often begin with fake or compromised websites that mimic CAPTCHA prompts, leading victims to copy and paste malicious code into their system's terminal applications. Once executed, the commands install info-stealing malware capable of extracting passwords, account access, and cryptocurrency wallet data. The latest ClickFix campaign involved hackers compromising HBO Max’s official Reddit page to post fake advertisements designed to look legitimate but contain harmful prompts. Security researchers from Hudson Rock have identified this as a growing international threat that is becoming increasingly sophisticated in its execution. Despite the severity of these attacks, it remains unclear how many users were affected or compromised. While developers often use terminal commands for troubleshooting, regular computer users are less familiar with them and more likely to fall victim to such social engineering tactics. Security experts suggest tools like BlockBlock can help mitigate risks on Mac systems, while enterprise Windows environments may block access to terminals altogether.
Topics: clickfix attacks hacking HBO Max malware Reddit