Fake HBO Max Reddit ads told Mac users to install their own malware

Why it matters

ClickFix lets attackers bypass normal download warnings by making the victim execute the malware. A verified brand account and paid ad placement make that instruction look routine.

A malicious advertising campaign impersonating HBO Max directed Reddit users to a counterfeit Mac download page, then instructed them to paste a command into Terminal that installed information-stealing malware.

The ads appeared under HBO Max's official, verified Reddit account, according to TechCrunch's September 14th report, which cited security researchers at Hudson Rock and reports posted by Reddit users. Researchers said attackers had gained control of the account and used it to publish a large batch of paid ads.

One Reddit user documented the campaign on September 6th, after seeing an ad that promoted an HBO Max app for macOS. The ad led to a look-alike domain and presented a download button. Clicking it opened instructions telling the visitor to paste a command into Terminal.

That final step is the attack. The page does not need to break through the operating system by exploiting a software vulnerability. It persuades the user to run the attacker's code with their own account permissions.

The malware arrives as a technical instruction

The technique is known as ClickFix. A malicious or compromised website displays a fake CAPTCHA, verification request, download error or support message, then supplies a command for the visitor to copy and execute in Windows PowerShell, the Windows Run dialog or macOS Terminal.

Running the command can download an infostealer capable of collecting browser cookies, saved passwords, authentication data and cryptocurrency wallet credentials. The malicious command can also use legitimate operating-system utilities, making the activity harder for defenses built around spotting an unfamiliar downloaded application.

Microsoft Threat Intelligence has tracked ClickFix campaigns since early 2024. Microsoft said the technique was targeting thousands of enterprise and consumer devices globally each day by August 2025. In Microsoft's 2025 Digital Defense Report, ClickFix accounted for 47% of the initial access methods recorded in Defender Experts notifications during the report's measurement period.

Macs have become a growing target. In August, Microsoft documented a macOS ClickFix operation that used more than 250 front-end domains and browser fingerprinting to show malicious pages primarily to likely Mac users. That filtering allowed the same domain to serve harmless-looking material to automated scanners while presenting a fake download and Terminal command to selected visitors.

The HBO Max campaign added two forms of borrowed trust: a verified brand account and Reddit's advertising system. A user did not have to arrive through an obvious spam email or an unknown social account. The malicious link appeared as a paid promotion attached to a familiar entertainment brand.

ClickFix is moving beyond the terminal

ClickFix operators are also changing where they ask victims to run code. On September 8th, Cisco Talos described a campaign that persuaded cryptocurrency users to paste JavaScript into Chrome or install it through a browser extension. The code altered cryptocurrency transaction pages and replaced legitimate deposit addresses with wallets controlled by the attackers.

That variation stayed inside the browser. The shared method was social engineering: attackers supplied code, invented a reason to run it and let the victim cross the security boundary for them.

Microsoft has also documented ClickFix payloads that deliver remote-access tools, loaders and rootkits in addition to infostealers. The technique has become useful across malware campaigns because the initial execution looks like an intentional action by the logged-in user.

A Terminal command is the warning sign

A legitimate CAPTCHA, streaming-service download or account verification process should never require a consumer to open PowerShell, the Windows Run dialog or Terminal and execute copied text. Seeing the fake page or copying its command does not complete the infection. Executing the command does.

Apple added terminal and script protections in macOS 26.4. Apple says compatible Macs can warn users about suspicious paste activity and block commands or scripts associated with known malware. The protections still leave an override for some warnings, so the prompt cannot protect a user who accepts the alert and continues.

Mac users can also use Objective-See's BlockBlock, which includes an optional paste-protection mode designed to stop or flag Terminal pastes associated with ClickFix attacks. Microsoft recommends that organizations restrict access to Windows command tools where employees do not need them, monitor unusual command execution and train staff that verification pages do not require pasted system commands.

Anyone who executed a command supplied by the fake HBO Max page should treat the device and credentials stored on it as exposed. The malware associated with these campaigns is built to steal active sessions and authentication data, which means changing one password on the affected computer does not address the wider compromise.