Written by Admin Alex · Fact-Checked by M.Ali · Info Verified September 2026
We review and update this article regularly as new information becomes available.
TL;DR: ClickFix attacks show users a fake CAPTCHA, then instruct them to copy a text command into their own Terminal or Command Prompt. Running it installs info-stealing malware instantly, bypassing most antivirus tools because the user technically did it themselves. A recent wave used a hijacked HBO Max advertising account on Reddit to spread it. Security researchers Kevin Beaumont and Hudson Rock have both flagged it as an active, growing threat on Mac and Windows alike.
You’ve filled out a hundred CAPTCHAs. Click the box, sometimes pick out the traffic lights, move on with your day. That familiarity is exactly what ClickFix attacks exploit, and it’s why they’re working on people who’d never fall for an obvious phishing email.
How it actually works
The attack starts on a fake site, or increasingly, a legitimate site running compromised ads. It shows something that looks like a routine CAPTCHA or anti-bot checkbox. Clicking it triggers a prompt claiming you need to complete a quick verification step. The instructions then ask you to open your Terminal, on a Mac, or Command Prompt or PowerShell on Windows, and paste in a string of text they provide.
The moment you hit return, malware installs. No download prompt, no file to double-click, no obvious warning sign. Because the command runs directly through the operating system rather than through a file security software would normally scan, it slips past a lot of standard antivirus protection entirely.
The HBO Max angle
One of the more notable recent campaigns didn’t rely on some sketchy unknown website at all. Attackers compromised an HBO Max advertising account that was authorized to run ads on Reddit, then used it to push ads linking to a fake HBO Max login page carrying the ClickFix lure. Reddit confirmed the compromise but hasn’t disclosed how many people clicked through. That’s the uncomfortable part: this wasn’t some obviously shady corner of the internet, it was an ad running under a trusted, verified brand’s own account.
Why this fools people who know better
Most security awareness training focuses on not clicking suspicious links or downloading unexpected files. ClickFix sidesteps all of that. You’re not downloading anything. You’re not clicking an executable. You’re pasting text into a tool you already trust, on your own machine, because a webpage told you it was a normal verification step. It’s social engineering aimed at the gap in most people’s mental model of what “safe” looks like.
What actually protects you
If you’re an IT administrator managing Windows machines, blocking terminal access at the domain level closes this off entirely for a managed fleet. For individual Mac users, a tool like BlockBlock can flag and block this kind of terminal-level exploitation attempt before it runs. But the simplest rule covers most of it: no legitimate CAPTCHA, ever, asks you to open a terminal and paste something in. If a “verification” step wants you touching Terminal or Command Prompt, close the tab.
Bottom Line
ClickFix works because it targets trust in your own operating system’s tools rather than trust in a stranger’s file. That’s a smarter attack than most of what circulates, and it’s spreading through channels, like compromised ad accounts on major platforms, that don’t look shady at all. The fix isn’t more vigilance about sketchy links. It’s a hard rule: nothing legitimate ever needs you in a terminal to prove you’re not a robot.
