Hackers Exploit Reddit Ads in Sophisticated "ClickFix" Malware Campaign A recent surge in "ClickFix" attacks a growing cybersecurity threat in 2026 has targeted users through deceptive ads on Reddit, tricking victims into installing malware on their own devices. Security researchers at Hudson Rock and ADAMnetworks, along with reports from Reddit’s cybersecurity community, revealed that hackers compromised an official HBO Max Reddit ad account to post hundreds of fake but convincing advertisements. The malicious ads directed users to a spoofed HBO Max page, where they encountered a fake CAPTCHA or anti-bot prompt. Upon clicking, victims were instructed to copy and paste a command into their Windows Command Prompt or macOS Terminal, which instantly deployed info-stealing malware. The malware could harvest passwords, logged-in session data, and cryptocurrency wallet credentials, bypassing traditional antivirus defenses by exploiting terminal-based execution. Reddit confirmed the breach, stating that the compromised HBO Max ad account was locked and the malicious ads removed, though the company did not disclose how many users were affected. Warner Bros. Discovery, HBO’s parent company, did not respond to requests for comment. While terminal-based attacks are more common among developers, security experts warn that blocking access to Command Prompt, PowerShell, or Terminal across corporate networks can mitigate risks. For Mac users, tools like BlockBlock may help prevent such self-inflicted compromises. The full scale of the campaign remains unclear, but the incident highlights the evolving sophistication of social engineering tactics in cybercrime.