27
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads (www.bleepingcomputer.com)
submitted 1 month ago by to c/cybersecurity@sh.itjust.works
2 comments fedilink hide all child comments
 

Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware.

Security researchers at Hudson Rock and ADAMnetworks analyzed the campaign and say the verified u/hbomax Reddit account was hijacked and used to launch 108 malicious advertisements over about 48 hours.

The ads used a social engineering technique known as ClickFix, which tricks users into copying and pasting malicious commands into Windows Run, PowerShell, or macOS Terminal while pretending to fix an error, verify a CAPTCHA, or install legitimate software.

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 month ago* (1 child)

I guess it's a good reminder to let computer challenged friends and family know that they should never paste code frok the Internet into their computer consoles/powershell/terminal/run interface. Even if you know what you're doing, use a text editor to review what it is that your about to run

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 1 month ago

    ClickFix attacks often prey on the fact that people don't understand what key combinations do. The examples I've dealt with professionally (read: my company's users ran into them), have directed the user to press the following keys in order:

    +R
    +V

    Some folks may recognize the +V as paste, but many don't and only think of + as paste. And it's mostly tech-savvy people who would recognize +R as opening the run box. Since the code gets pre-loaded in the clipboard with JavaScript, the user never sees the code on the webpage and may not realize that their clipboard is loaded with the malicious code. Again, for tech-savvy users, this should be obvious. For everyone else, it's just another annoying CAPTCHA they have to deal with.

  • permalink
  • fedilink
  • source
  • parent