Trusted Platforms, Malicious Payloads
Between July and September 2026, attackers hijacked a verified HBO Max Reddit account and ran 108 malicious advertisements over 48 hours. The ads promoted fake HBO Max software, AI tools, and developer utilities. Users who clicked were redirected to websites using the ClickFix social engineering technique — fake error pages or verification prompts instructing victims to copy commands and paste them into PowerShell or Terminal.
Once executed, those commands downloaded and installed information stealers, cryptocurrency clippers, malware loaders, and fake wallet applications. Similar campaigns targeted X (formerly Twitter) with fake DynamicLake ads, compromised over 700 education and technology websites with fake Cloudflare verification pages, and distributed fake OpenAI Codex and ChatGPT applications. Kaspersky detected 92,000 malicious attacks disguised as AI services in 2026 alone.
The common thread: attackers exploited trust. Verified accounts, familiar brands, legitimate websites, routine security checks. All designed to make a malicious command look like a normal action.
But every single one of these attacks has the same technical requirement: the malware payload must write executable files to disk before it can run.
Why ClickFix Works — And Where It Fails
ClickFix bypasses traditional download warnings because victims aren’t opening an attachment or clicking an .exe file. They’re running a command. The PowerShell or Terminal instruction looks like a troubleshooting step or an installation process. The user’s guard is down because the context feels legitimate.
But the command still has to download and write an executable payload to the file system. A PowerShell script that installs malware is writing .exe, .dll, .ps1, or other executable formats to disk. A fake verification page that delivers a trojan is writing files. The social engineering is upstream, but the file operation is unavoidable.
That’s where kernel-level file system control applies. FileSure Defend operates as a Windows kernel filter driver, intercepting file operations before they complete. You define which programs are allowed to perform which operations on which file types. When an unauthorized program — or an authorized program behaving suspiciously — attempts to write an executable file, the operation is blocked at the kernel level.
The payload never lands. The malware never executes. The attack stops.
A Specific Rule That Would Have Blocked These Campaigns
Here’s a FileSure rule configuration that would have prevented the HBO Max, DynamicLake, and fake AI software attacks:
File name filter: *.exe;*.dll;*.bat;*.cmd;*.ps1;*.vbs;*.wsh
Program name filter: \powershell.exe;\cmd.exe;\wscript.exe;\cscript.exe
Operations: Write, Create
Drive type: Hard drives, Workstations
Action: Block
This rule prevents PowerShell, Command Prompt, and Windows Script Host from writing executable or script files to local drives. Legitimate software installations that require elevated permissions can be excluded. Self-updating applications can be added to an exception list. But arbitrary commands pasted from a website? Blocked.
The ClickFix technique relies on the victim executing the command. But it also relies on that command being able to write files. Remove the second part, and the first part doesn’t matter.
The HBO Max campaign ran for 48 hours and delivered 108 distinct ads. It targeted both Windows and macOS users. The payloads varied: information stealers, cryptocurrency clippers, loaders, fake wallet apps. But every Windows payload had to write to the file system. Every single one would have been stopped by a kernel-level write block on executable formats.
This isn’t signature-based detection. It’s not waiting for a vendor to analyze the malware and push an update. It’s controlling what programs are allowed to do to your files, regardless of what the malware looks like or where it came from.
Attackers will keep exploiting trust. They’ll compromise more verified accounts, buy more ads, hijack more legitimate websites. The social engineering will get better. But the file system operations stay the same. Malware has to write itself to disk before it can run. Block the write, stop the attack.
Try FileSure Defend free for 21 days at bystorm.com and see how kernel-level file system control stops malware before it executes.
Category: Threat Intelligence
Tags: clickfix, social engineering, powershell malware, information stealer, kernel filter driver, file system security, malware delivery, hbo max reddit attack
