CLICKFIX ATTACKS ARE TRICKING MAC AND WINDOWS USERS INTO HACKING THEMSELVES

Summary from the TLDR InfoSec newsletter

Attackers hijacked HBO Max's Reddit advertising account and posted malicious ads. The ads led to fake HBO Max pages with CAPTCHA-style ClickFix prompts that made the victims copy commands into Windows Command Prompt, PowerShell, or macOS Terminal. The commands installed infostealers that targeted passwords, active sessions, and crypto wallets. Reddit paused the ads three days after a user flagged them, though how the account was taken over remains unknown.