ClickFix attacks are tricking Mac and Windows users into hacking themselves

Security researchers have identified a rising “ClickFix” campaign in which attackers used a compromised HBO Max Reddit advertising account to post malicious ads linking to pages that trick users into pasting commands into Windows Command Prompt or macOS Terminal; executing the pasted commands installs info-stealing malware that can harvest passwords, session access, and crypto wallets. The campaign relies on social-engineering via fake CAPTCHAs and copy-paste prompts to bypass traditional defenses, and defenders are advised to restrict terminal access and use platform-specific protections.