A cybersecurity campaign dubbed 'ClickFix' has emerged, targeting users of both macOS and Windows operating systems. The attack typically begins when a user interacts with a deceptive advertisement, such as a fake HBO Max promotion found on platforms like Reddit. Once the user clicks the ad, they are presented with a fraudulent prompt that mimics a system error or a necessary software update.

The 'ClickFix' method relies on social engineering rather than traditional software vulnerabilities. By convincing the user that their system requires a manual fix—often involving copying and pasting a command into the terminal or command prompt—the attackers gain unauthorized access to the victim's machine. This technique effectively tricks users into bypassing their own security protections by performing the malicious actions themselves.

Security researchers have noted that this trend highlights a shift toward exploiting user behavior rather than just technical flaws in operating systems. Because the user is prompted to manually execute the malicious script, standard antivirus software may not immediately flag the activity as an intrusion. Experts advise users to remain skeptical of unexpected pop-ups or error messages, particularly those that instruct them to copy and paste commands from a website into their system's terminal or command line interface.