Reported by 15 outlets
ClickFix Campaigns Targeting End Users via Legitimate Services
Why this score
- Breadth
- 2.00 / 2.0 · 15 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
ClickFix is delivery by self-inflicted execution: the victim copies a command from a web page and runs it personally in Windows Run, PowerShell, or macOS Terminal to fix a fake error, pass a fake CAPTCHA, or install software that does not exist. The clearest instance in this story is PasteSwitch, where Hudson Rock and ADAMnetworks found the verified u/hbomax Reddit account hijacked to push 108 malicious advertisements in about 48 hours across five lure groups, funneling users to hbomaxx[.]us and a paste-and-run prompt: curl piped to zsh on macOS delivering MacSync, AMOS Helper, and fake wallet apps; MSHTA and PowerShell on Windows delivering Amatera Stealer, which validates stolen credentials manually and disguises its C2 as Facebook connections. CTM360's report, now echoed across multiple outlets, cataloged roughly 17,000 ClickFix URLs living on otherwise trusted websites and describes the technique as a leading initial access vector, and the feed shows the current frontline is compromised legitimate infrastructure: hacked Ukrainian business sites serving fake Cloudflare verification pages, more than 5,400 hacked small-business sites storing payloads in BNB Smart Chain contracts, and a Brevo CDN compromise.
The numbers argue this is not a niche trick. Hudson Rock's original ErrTraffic disclosure recorded a 58.8 percent conversion rate on the lure dashboard, twenty downloads from thirty-four views, and Sekoia's research found the framework operating as subscription malware-as-a-service at $380 a month with C2 resolved through EtherHiding smart contracts on the Polygon blockchain. Malvertising is normally measured in fractions of a percent, so a lure that converts at tens of percent while executing inside system utilities the browser never observes changes the economics of stolen credentials. The event list presents the HBO Max ads, the Brevo CDN incident, and the Ukrainian sites as separate stories, but they are one economy: infostealers harvest CMS credentials, those credentials inject new ClickFix lures into trusted sites, and the new lures harvest again.
Hunt at the paste boundary. Enable PowerShell ScriptBlock logging and alert on the ErrTraffic command shape Sekoia published: ScriptBlockText beginning with "<" and containing "#>", "-bxor[int][char]$", and "[convert]::ToInt32". Correlate browser-launched spawns of mshta.exe and powershell.exe, hunt curl piped into zsh on macOS, and flag egress to blockchain RPC endpoints followed by a PowerShell launch. On WordPress and Ghost estates, inspect for mu-plugin and injected JavaScript artifacts, patch Ghost against CVE-2026-26980, and rotate administrator credentials. Turn on the friction that now exists: the Terminal paste warning in macOS Tahoe 26.4, Opera's Paste Protect, and the ACSC's advisory on ClickFix-delivered Vidar as help-desk awareness material.
Two developments would change the assessment. Microsoft's TerminalFix warning showed ClickFix payloads deploying reverse tunnels after the paste, which converts a one-shot stealer into durable interactive access; if that variant spreads, this stops being a malvertising problem and becomes an intrusion problem. And if blockchain-resolved C2 keeps spreading past ErrTraffic into supply-chain positions like the Brevo CDN incident, domain takedowns and blocklists lose their grip, because the pointer lives on-chain.
Timeline
-
update from infostealers.com
The Industrialization of "ClickFix": Inside ErrTraffic
infostealers.com · 289d ago · December 29th, 2025
Hudson Rock's original disclosure of ErrTraffic, a ClickFix delivery suite promoted by the actor LenAI on Russian-language forums and sold for $800. The tool injects a single script tag into compromised websites, renders fake glitch, font, or CAPTCHA lures, fingerprints the victim OS, and copies a PowerShell command to the clipboard. A campaign dashboard in the report showed a 58.8 percent conversion rate (20 downloads from 34 views), with Lumma, Vidar, and Atomic (AMOS) among the deliverable stealers.
-
update from bleepingcomputer.com
Apple adds macOS Terminal warning to block ClickFix attacks
bleepingcomputer.com · 198d ago · March 30th, 2026
Apple introduced a security feature in macOS Tahoe 26.4 that blocks pasting and executing potentially harmful commands in Terminal and alerts users to the risk. BleepingComputer framed it as a direct platform-level countermeasure to ClickFix attacks on macOS users.
-
update from bleepingcomputer.com
Australia warns of ClickFix attacks pushing Vidar Stealer malware
bleepingcomputer.com · 160d ago · May 7th, 2026
The Australian Cyber Security Center (ACSC) warned organizations about an ongoing malware campaign using the ClickFix social engineering technique to distribute the Vidar Stealer info-stealing malware. BleepingComputer's coverage is an early government-level warning on the technique.
-
update from bleepingcomputer.com
Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign
bleepingcomputer.com · 143d ago · May 24th, 2026
BleepingComputer reported a large-scale campaign exploiting a critical SQL injection vulnerability tracked as CVE-2026-26980 in Ghost CMS to inject malicious JavaScript that triggers ClickFix attack flows on compromised publications.
-
update from bleepingcomputer.com
Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks
bleepingcomputer.com · 135d ago · June 1st, 2026
BleepingComputer reported on DriveSurge, a threat actor operating large-scale malware distribution campaigns using ClickFix and FakeUpdates techniques on thousands of compromised websites.
-
update from sekoia.com
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework
sekoia.com · 120d ago · June 16th, 2026
Sekoia's TDR team published detailed research on the ErrTraffic ClickFix framework, which had grown from Hudson Rock's late-2025 disclosure into subscription malware-as-a-service with rentals rising from $300 to $380 per month in the first half of 2026. The report documents two operator clusters, Analytics and Beer, that inject the framework into compromised WordPress sites, resolve C2 through EtherHiding smart contracts on the Polygon blockchain, and deliver Vidar, Stealc, Remus, Salat, and SmokeLoader. It also publishes a detection pattern for ErrTraffic's XOR-decoding PowerShell commands based on ScriptBlockText logging.
-
update from bleepingcomputer.com
Opera rolls out Paste Protect feature to fight ClickFix attacks
bleepingcomputer.com · 104d ago · July 2nd, 2026
Opera introduced Paste Protect, a browser security feature designed to block ClickFix-style attacks that trick users into executing malicious commands pasted from web pages. BleepingComputer described it as one of the first browser-side mitigations aimed specifically at paste-and-run social engineering.
-
update from bleepingcomputer.com
Microsoft warns of TerminalFix attacks deploying reverse tunnels
bleepingcomputer.com · 44d ago · August 31st, 2026
Microsoft warned about TerminalFix, a ClickFix variant that uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal and then deploys reverse tunnels. BleepingComputer reported the warning nine days before this story's first_seen.
-
update from bleepingcomputer.com
Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain
bleepingcomputer.com · 39d ago · September 5th, 2026
BleepingComputer reported a massive cybercriminal operation leveraging more than 5,400 compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain.
-
mentioned by www.darkreading.com
Multi-hop Google redirect phishing campaign
www.darkreading.com · 34d ago · September 9th, 2026
-
update from www.darkreading.com
ClickFix campaigns using legitimate services for persistent access
www.darkreading.com · 34d ago · September 9th, 2026
ClickFix campaigns using legitimate services for persistent access
via Mastodon https://www.darkreading.com/endpoint-security/clickfix-campaigns-legitimate-services-persistent-access
-
update from arstechnica.com
ClickFix attacks infecting PCs and Macs are going viral Simplicity—combined with the difficulty of getting stuff done—makes ClickFix ideal.
arstechnica.com · 32d ago · September 11th, 2026
ClickFix attacks infecting PCs and Macs are going viral Simplicity—combined with the difficulty of getting stuff done—makes ClickFix ideal.
-
update from www.darkreading.com
Voice Caller Exploitation Campaigns Targeting BYOD and Microsoft 365 Corporate Data
www.darkreading.com · 30d ago · September 13th, 2026
🖲️ # Cybersecurity # Ciberseguridad # Ciberseguranca # Security # Seguridad # Seguranca # News # Noticia # Noticias # Tecnologia # Technolog
via Mastodon https://www.darkreading.com/threat-intelligence/voice-callers-exploit-byod-microsoft-365-corporate-data
-
update from arstechnica.com
ClickFix attacks infecting PCs and Macs are going viral
arstechnica.com · 29d ago · September 14th, 2026
submitted by /u/NISMO1968 [link] [comments]
via reddit r/cybersecurity: ClickFix attacks infecting PCs and Macs are going viral
-
update from malware.news
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation
malware.news · 29d ago · September 14th, 2026
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation In September 2026, the Reddit cybersecurity community uncovered a massive, highly coordinated malvertising campaign leveraging the official, verified HBO Max Reddit account ( u/hbomax ). Over a frantic 48-hour period, the compromised account pushed 108 distinct “ClickFix” advertisements to users across the platform. Through joint research conducted by Hudson Rock and Kirk from ADAMnetworks (with additional thanks to Tuxxin from Whack.sh and Emiliano from The Matrix Project), we can confirm this incident is part of a massive, cross-platform delivery operation we are dubbing PasteSwitch . This operation spans macOS stealers, Windows loaders, deceptive TLS tactics, and contract-controlled cryptocurrency clippers. Initial Discovery The incident was brought to light by a vigilant user in the r/cybersecurity subreddit. While browsing the platform, they encountered an official Reddit advertisement authored by the verified u/hbomax account. The ad aggressively promoted a native macOS application for HBO Max, a standalone application that does not currently exist. Intrigued, the user followed the advertisement to a high
-
update from bleepingcomputer.com
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads
bleepingcomputer.com · 29d ago · September 14th, 2026
The ads used a social engineering technique known as ClickFix, which tricks users into copying and pasting malicious commands into Windows Run, PowerShell, or macOS Terminal while pretending to fix an error, verify a CAPTCHA, or install legitimate software. The type of attack has become increasingly popular among cybercriminals because victims run the malicious commands themselves using legitimate operating system tools, potentially bypassing some browser and security software designed to detect malware downloads. Hudson Rock and ADAMnetworks have linked the attack to a larger campaign they call PasteSwitch, which targets both Windows and macOS systems and has been used to distribute information stealers, loaders, cryptocurrency clippers, and fake cryptocurrency wallet applications. The researchers say PasteSwitch refers to the operation's use of attacker-supplied commands that victims paste into their systems, while the at
-
update from www.hudsonrock.com
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads Indicators extracted from public reporting. Source: https://www. hudso
www.hudsonrock.com · 29d ago · September 14th, 2026
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads Indicators extracted from public reporting. Source: https://www.
-
mentioned by cyberworldops.eu
HBO Max's verified Reddit account (u/hbomax) was compromised and used to publish 108 ClickFix ads over 48 hours targeting Windows and macOS.
cyberworldops.eu · 29d ago · September 14th, 2026
-
update from www.virustotal.com
Spotted the same thing from here. @brevo_official CDN compromise Be careful out there! https:// virustotal.com/gui/url/545cf8 c6e356c1bc9b06
www.virustotal.com · 29d ago · September 14th, 2026
Spotted the same thing from here. @brevo_official CDN compromise Be careful out there! https:// virustotal.com/gui/url/545cf8 c6e356c1bc9b06
via X https://www.virustotal.com/gui/url/545cf8c6e356c1bc9b0616e3bb86e756ddde7cda2f75ba4b261c97f3cce878fc/details
-
update from www.virustotal.com
Beyond the ClickFix attack (didn't get the paylod), there's a script https:// virustotal.com/gui/url/545cf8 c6e356c1bc9b0616e3bb86e756ddde7c
www.virustotal.com · 29d ago · September 14th, 2026
Beyond the ClickFix attack (didn't get the paylod), there's a script https:// virustotal.com/gui/url/545cf8 c6e356c1bc9b0616e3bb86e756ddde7c
via X https://www.virustotal.com/gui/url/545cf8c6e356c1bc9b0616e3bb86e756ddde7cda2f75ba4b261c97f3cce878fc/gti-summary
-
update from techcrunch.com
ClickFix attacks are tricking Mac and Windows users into hacking themselves If you clicked on a fake HBO Max ad on Reddit in the past week,
techcrunch.com · 29d ago · September 15th, 2026
ClickFix attacks are tricking Mac and Windows users into hacking themselves If you clicked on a fake HBO Max ad on Reddit in the past week,
via Mastodon https://techcrunch.com/2026/09/14/clickfix-attacks-are-tricking-mac-and-windows-users-into-hacking-themselves/
-
update from securityweek.com
Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack
securityweek.com · 28d ago · September 15th, 2026
Clicking the malicious ads led users to hbomaxx[.]us, a page mimicking the official HBO Max site that also contained a download button. “The download button opened a ClickFix prompt that told the visitor to copy a command, open Terminal, paste the command, and run it. This transferred execution from the browser to a trusted system utility under the victim’s control,” ADAMnetworks explains. On macOS, the attack relied on curl | zsh commands to deliver malware such as MacSync , AMOS Helper, fake wallet applications, and other malicious code to steal users’ information, including their credentials, messages, browser information, and cryptocurrency wallet information, and gain persistent access to their machines. On Windows, the attack relied on MSHTA and PowerShell to deliver the Amatera Stealer and achieve persistence. Configured for manual credential validation, the malware would bypass network telemetry by spoofing Facebook connections to hide its command-and-control (C&C) commun
-
mentioned by www.theregister.com
HBO Max Reddit account compromised to serve ClickFix attacks Part of a 'massive 48-hour malvertising blitz' targeting macOS and Windows mach
www.theregister.com · 28d ago · September 15th, 2026
-
update from www.ctm360.com
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360 Indicators extracted from public reporting. Sour
www.ctm360.com · 19d ago · September 24th, 2026
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360 Indicators extracted from public reporting.
-
update from thehackernews.com
Active ClickFix campaign: threat actors compromised legitimate Ukrainian business sites to inject fake Cloudflare verification pages
thehackernews.com · 19d ago · September 24th, 2026
🤖 Active ClickFix campaign: threat actors compromised legitimate Ukrainian business sites to inject fake Cloudflare verification pages and
via Mastodon https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html
-
mentioned by threatnoir.com
⚠️ CRITICAL: 17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360 ClickFix is now the leading initial
threatnoir.com · 17d ago · September 26th, 2026