Attackers took over the verified official HBO Max Reddit account and used it to run a 48-hour wave of malicious ads. The ads sent people to lookalike download sites that tricked them into copying and running commands, leading to information-stealing malware on both macOS and Windows. Researchers say the attackers rapidly rotated domains and selectively showed malicious content to avoid detection.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re scrolling Reddit, see an ad from the verified u/hbomax account, and think, “Cool, an HBO Max macOS app.” But that HBO Max account was hijacked. The ad sends you to hbomaxx.us, a lookalike site that tells you: copy this command into Terminal or PowerShell to download the app. That’s ClickFix: you paste the command, it quietly installs info‑stealing malware. On macOS it’s curl piped to zsh; on Windows it’s mshta and PowerShell, all triggered by you. If any site, HBO Max, OpenAI, whatever, tells you to paste a command to install or fix something, stop. Don’t run it. Screenshot it and send it to IT or Security.
Researchers reported that criminals hijacked HBO Max’s verified Reddit account and used it to run malicious ads that led people to fake download sites. The sites didn’t provide real installers, instead they tricked users into pasting and running commands in Terminal/PowerShell, causing them to…
Attackers took over the verified HBO Max Reddit account and ran over 100 malicious ads that sent people to fake download pages. The pages used a ClickFix-style trick: users were told to copy/paste a command into macOS Terminal (and similar OS-targeted lures) to install information-stealing malware.
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
Rapid7 uncovered an active cryptocurrency fraud operation that combined phishing emails, follow-up phone calls, and counterfeit wallet apps to trick victims into handing over wallet recovery (seed) phrases. The attackers validated and enriched phone-number leads first, then used matching “support…
