ClickFix attacks are tricking Mac and Windows users into hacking themselves

A fake HBO Max ad on Reddit reportedly exposed users to a growing ClickFix threat that tricks victims into carrying out the attacker’s instructions themselves. The attack affects both Mac and Windows users, making social engineering the main delivery mechanism rather than a platform-specific exploit.

ClickFix campaigns show how attackers are shifting toward user-driven compromise, bypassing some technical defenses by persuading people to run commands or install payloads voluntarily. The cross-platform targeting also highlights why ad platforms and communities need faster detection of malicious promotions.