Hackers hijack HBO Max Reddit account to push malware in ClickFix ads

There's something deeply unsettling about this attack that goes beyond the technical mechanics. We've built our digital lives on a foundation of trust—trust in brand accounts, trust in verification badges, trust in the platforms we visit daily. When a hacker seizes control of HBO Max's Reddit presence, they're not just stealing credentials; they're weaponizing our own psychological shortcuts against us. It's a form of social engineering that exploits our tendency to let our guard down when we see a familiar logo. The ClickFix technique is particularly clever in its simplicity. Rather than exploiting a zero-day vulnerability or brute-forcing passwords, it leverages something far more fundamental: our muscle memory. When users are presented with a fake CAPTCHA asking them to run a command, many comply without thinking—it's become an almost reflexive response in our daily browsing. This is the quantum mechanics of trust: observation changes the outcome. By observing a trusted brand account, users' behavior shifts, making them more susceptible to manipulation. What makes this attack so fascinating from a broader perspective is how it mirrors the fundamental weirdness of identity in the digital age. In physics, we grapple with the observer effect—the idea that the act of measurement alters the system being measured. Here, we see a similar phenomenon: the act of authenticating (verifying a CAPTCHA) alters the security state of the system. The user believes they're proving they're human, but they're actually executing code that steals their digital identity. This incident also highlights an uncomfortable truth about our information ecosystem: authenticity is increasingly performative. The HBO Max account had all the markers of legitimacy—verified status, brand recognition, established history—yet it was completely compromised. In a world where AI can generate convincing deepfakes and hackers can hijack trusted channels, how do we verify what's real? The answer may lie in moving beyond simple trust signals toward more robust, cryptographic forms of verification—but that's a future we haven't built yet. Source: https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/