Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another used fake download pages to convince macOS users to paste a malicious command. The result is device takeover or information theft, including credential and crypto-wallet theft.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re scrolling Reddit and see a sponsored post from verified u/hbomax telling you to install an update. Looks legit, right? Click that ad and you land on a fake Spotify page: "Update required: Download the latest Spotify installer to continue." The MSI runs with msiexec.exe and silently drops ChainScript RAT using hidden PowerShell and VBScript. On macOS, a fake Codex download page goes further, telling you to paste a command into Terminal. That one step can launch Atomic Stealer and hand over your passwords and crypto wallets. Here’s the move: if a website or ad tells you to install an app or paste a command, stop and get it from our company portal or the vendor’s official site instead.
Researchers reported that criminals hijacked HBO Max’s verified Reddit account and used it to run malicious ads that led people to fake download sites. The sites didn’t provide real installers, instead they tricked users into pasting and running commands in Terminal/PowerShell, causing them to…
Attackers compromised HBO Max’s verified Reddit advertising account and used it to run 108 malicious ads in about 48 hours. The ads sent people to attacker-controlled websites that used “ClickFix” instructions to trick users into running commands that installed malware on Windows and macOS.
Attackers took over the verified official HBO Max Reddit account and used it to run a 48-hour wave of malicious ads. The ads sent people to lookalike download sites that tricked them into copying and running commands, leading to information-stealing malware on both macOS and Windows. Researchers…
Attackers used a fake Cloudflare “verify you are human” overlay to copy a command to victims’ clipboards and trick them into pasting it into Windows Terminal/PowerShell. The command kicked off a multi-stage infection chain, including downloading payloads hidden inside PNG images, establishing…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
