ClickFix attacks are tricking Mac and Windows users into hacking themselves
ClickFix attacks are tricking Mac and Windows users into hacking themselves
“ClickFix” 攻击正诱骗 Mac 和 Windows 用户亲手黑掉自己的电脑
If you clicked on an HBO Max ad on Reddit over the past week, you might want to check your computer for malware. These so-called “ClickFix” attacks have quickly become one of the rising cybersecurity threats of 2026, and they’re getting both sneakier and compromising people’s devices with greater frequency. 如果你在过去一周内点击过 Reddit 上的 HBO Max 广告，你可能需要检查一下电脑是否感染了恶意软件。这些所谓的“ClickFix”攻击已迅速成为 2026 年日益严重的网络安全威胁之一，它们不仅变得更加隐蔽，而且入侵用户设备的频率也越来越高。
Until recently, ClickFix attacks were a rarity, capitalizing on people searching the web for quick tech fixes. They have since evolved into a massive international effort to hack into people’s computers. 直到最近，ClickFix 攻击还非常罕见，它们通常利用人们在网上搜索快速技术解决方案的心理。但现在，它们已经演变成一种大规模的国际化黑客行动，旨在入侵用户的电脑。
The attacks involve fake websites, or legitimate websites that have been hacked, which display a message that appears to look like a CAPTCHA or an anti-bot checkbox. Once clicked, a prompt appears asking the user to perform a “check” to proceed, which gives instructions to copy and paste a string of text into the user’s Windows command prompt or Mac Terminal app. 这些攻击涉及虚假网站或被黑客入侵的合法网站，页面会显示一条看起来像验证码（CAPTCHA）或防机器人复选框的消息。一旦点击，系统会弹出一个提示，要求用户执行“检查”以继续，并指示用户将一段文本复制并粘贴到 Windows 命令提示符或 Mac 终端（Terminal）应用程序中。
As soon as the user hits return, they unwittingly and instantly install info-stealing malware on their computer, capable of immediately stealing their passwords, access to their logged-in accounts, and crypto wallets. Since the user is working in the computer’s terminal, which lets them interact directly with the operating system using text-based commands, many of these attacks evade antivirus and security defense tools. 用户一旦按下回车键，就会在不知不觉中立即在电脑上安装信息窃取恶意软件，该软件能够即刻窃取用户的密码、已登录账户的访问权限以及加密货币钱包。由于用户是在电脑终端中操作，这允许他们使用基于文本的命令直接与操作系统交互，因此许多此类攻击能够绕过杀毒软件和安全防御工具。
Security researchers now say that the latest ClickFix campaign they’ve seen involved hackers posting fake ads on Reddit, linking to a page that looks like HBO Max but contains a ClickFix lure that tricks people into hacking themselves. The hackers compromised the official HBO Max’s account on Reddit that was then used to post hundreds of fake but real-looking adverts to the news-sharing site, according to security researchers at Hudson Rock and a thread on Reddit’s cybersecurity subreddit. 安全研究人员表示，他们观察到的最新 ClickFix 活动涉及黑客在 Reddit 上发布虚假广告，链接到一个看起来像 HBO Max 的页面，但其中包含诱导用户“自黑”的 ClickFix 陷阱。据 Hudson Rock 的安全研究人员以及 Reddit 网络安全板块的一个讨论帖称，黑客入侵了 HBO Max 的官方 Reddit 账号，并利用该账号在这一新闻分享网站上发布了数百条虚假但看起来非常真实的广告。
It’s unclear how many people clicked on these fake ads or how many were ultimately compromised as a result. Warner Brothers Discovery, which owns HBO, did not respond to a request for comment. Reddit told TechCrunch it “recently learned that an HBO Max account authorized to run advertisements on Reddit was compromised and used to run ads containing malicious links,” and that the company locked the account and removed the ads. When asked, Reddit did not say how many users were targeted or clicked the malicious ads. 目前尚不清楚有多少人点击了这些虚假广告，或最终有多少人因此受到侵害。HBO 的母公司华纳兄弟探索频道（Warner Brothers Discovery）未回应置评请求。Reddit 向 TechCrunch 表示，公司“最近获悉一个获准在 Reddit 上投放广告的 HBO Max 账号被入侵，并被用于投放包含恶意链接的广告”，公司已锁定该账号并删除了相关广告。当被问及有多少用户成为目标或点击了这些恶意广告时，Reddit 未予置评。
While it’s typical for developers to run one-line snippets of code in their computer’s terminal, it’s less common for regular users to use the Command Prompt or PowerShell in Windows, or the Terminal in macOS. Companies that run fleets of Windows computers can block access to these features across the entire domain to prevent them from being exploited, per security researcher Kevin Beaumont. As noted by Ars Technica, a tool for Mac users called BlockBlock can also defend against attacks that try to trick Apple users into hacking themselves. 虽然开发人员在电脑终端运行单行代码片段是常态，但普通用户使用 Windows 的命令提示符（Command Prompt）或 PowerShell，以及 macOS 的终端（Terminal）并不常见。安全研究员 Kevin Beaumont 指出，管理大量 Windows 电脑的企业可以在整个域内阻止对这些功能的访问，以防止其被利用。正如 Ars Technica 所指出的，一款名为 BlockBlock 的 Mac 工具也可以防御此类试图诱骗苹果用户“自黑”的攻击。