HBO Max Reddit Account Hijacked to Push ClickFix Malware Ads: Detection and Defense Guide for Infostealer Campaigns

---
title: ClickFix Style PowerShell Launched via Windows Run Dialog
id: 3f8c2a71-9b4e-4d5a-b6c7-1e2f3a4b5c6d
status: experimental
description: Detects PowerShell spawned directly by explorer.exe with download cradle or obfuscation flags, consistent with ClickFix paste-and-run social engineering where users paste malicious commands into Win+R.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/
  - https://attack.mitre.org/techniques/T1204/004/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/02/17
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'iex'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'curl'
      - '-enc'
      - '-e '
      - 'FromBase64String'
      - 'DownloadString'
      - 'Start-BitsTransfer'
  condition: all of selection_*
falsepositives:
  - Rare; legitimate administrators may run PowerShell from the Run dialog, but almost never with encoded download cradles
level: high
---
title: ClickFix LOLBin Execution with Remote URL via Run Dialog
id: 6a1d4e82-3c7f-4a9b-8d2e-5f6a7b8c9d0e
status: experimental
description: Detects mshta, rundll32, or wscript launched by explorer.exe with an HTTP URL in the command line, a common ClickFix first-stage pattern after a user pastes a malicious command into Win+R.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/02/17
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.005
  - attack.t1204.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cli:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  condition: all of selection_*
falsepositives:
  - Extremely rare; legitimate software does not typically launch mshta from the Run dialog with a remote URL
level: critical
---
title: Suspicious Copy-Paste Command Execution from Browser Process
id: 8b2e5f93-4d8a-4b1c-9e3f-6a7b8c9d0e1f
status: experimental
description: Detects script interpreters spawned directly by web browsers with execution flags, consistent with ClickFix variants that instruct users to paste commands into a terminal already open from a browser prompt.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/
  - https://attack.mitre.org/techniques/T1204/004/
author: Security Arsenal
date: 2026/02/17
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\conhost.exe'
  condition: all of selection_*
falsepositives:
  - Browser-integrated developer tools and some enterprise extensions; investigate command line before dismissing
level: medium

// Hunt for ClickFix-style paste-and-run execution chains across the fleet
// Looks for script interpreters and LOLBins spawned by explorer.exe (Run dialog) or browsers with network/obfuscation indicators
let suspiciousCli = dynamic(["iex", "Invoke-Expression", "Invoke-WebRequest", "iwr ", "curl", "DownloadString", "FromBase64String", "-enc", "Start-BitsTransfer", "http://", "https://"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("explorer.exe", "chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "rundll32.exe", "wscript.exe", "curl.exe")
| where ProcessCommandLine has_any (suspiciousCli)
| extend RemoteUrl = extract(@'(https?://[^\s"'']+)', 1, ProcessCommandLine)
| summarize Executions = count(), DistinctCommands = dcount(ProcessCommandLine), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, AccountName, FileName, ProcessCommandLine, RemoteUrl
| order by LastSeen desc

-- Hunt for ClickFix first-stage execution: script interpreters and LOLBins
-- spawned by explorer.exe or browsers with suspicious command lines
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       dict(Name=parent.Name, Exe=parent.Exe) AS Parent
FROM pslist()
LET parent <= SELECT Name, Exe FROM pslist(pid=Pid) LIMIT 1
WHERE (
  CommandLine =~ '(?i)(iex|invoke-expression|invoke-webrequest|downloadstring|frombase64string|curl|start-bitstransfer)'
  OR (Name =~ '(?i)mshta|rundll32|wscript' AND CommandLine =~ '(?i)https?://')
)

# ClickFix / Infostealer Endpoint Triage and Hardening Script
# Run elevated. Review output before taking destructive action.

# --- 1. Verify PowerShell Script Block Logging is enabled (required for forensics)
$sblPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
$sbl = Get-ItemProperty -Path $sblPath -Name EnableScriptBlockLogging -ErrorAction SilentlyContinue
if (-not $sbl -or $sbl.EnableScriptBlockLogging -ne 1) {
    Write-Host '[!] Script Block Logging NOT enabled. Enabling now for future forensics...' -ForegroundColor Yellow
    New-Item -Path $sblPath -Force | Out-Null
    Set-ItemProperty -Path $sblPath -Name EnableScriptBlockLogging -Value 1
} else {
    Write-Host '[+] Script Block Logging enabled.' -ForegroundColor Green
}

# --- 2. Search recent PowerShell Operational log for ClickFix-style cradles
Write-Host "`n[*] Scanning PowerShell logs for download cradles and encoded commands..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'iex|Invoke-Expression|DownloadString|FromBase64String|Invoke-WebRequest|Start-BitsTransfer|curl ' } |
  Select-Object TimeCreated, @{N='Snippet';E={$_.Message.Substring(0, [Math]::Min(300, $_.Message.Length))}} |
  Format-List

# --- 3. Check Run dialog MRU for pasted commands (ClickFix leaves forensic evidence here)
Write-Host "`n[*] Inspecting RunMRU for suspicious pasted commands..." -ForegroundColor Cyan
$runMru = Get-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -ErrorAction SilentlyContinue
if ($runMru) {
    $runMru.PSObject.Properties | Where-Object { $_.Name -match '^[a-z]$' } |
      ForEach-Object { if ($_.Value -match 'powershell|mshta|curl|http|iex') { Write-Host "[!] RunMRU hit: $($_.Value)" -ForegroundColor Red } }
}

# --- 4. Check common infostealer persistence locations
Write-Host "`n[*] Checking persistence keys for unexpected entries..." -ForegroundColor Cyan
$runKeys = @('HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    $entries = Get-ItemProperty -Path $key -ErrorAction SilentlyContinue
    if ($entries) {
        $entries.PSObject.Properties | Where-Object {
            $_.Value -match 'powershell|mshta|AppData|Temp|http' -and $_.Name -notmatch 'PSPath|PSParent|PSChild|PSDrive|PSProvider'
        } | ForEach-Object { Write-Host "[!] Suspicious persistence: $key :: $($_.Name) = $($_.Value)" -ForegroundColor Red }
    }
}

# --- 5. List recently created executables/scripts in user-writable staging dirs
Write-Host "`n[*] Recent files in common staging directories (last 72h)..." -ForegroundColor Cyan
$stagingDirs = @("$env:TEMP", "$env:LOCALAPPDATA\Temp", "$env:APPDATA", "$env:PUBLIC\Documents")
foreach ($dir in $stagingDirs) {
    Get-ChildItem -Path $dir -Recurse -Depth 1 -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-72) -and $_.Extension -match '\.(exe|ps1|bat|vbs|js|hta|dll)$' } |
      Select-Object FullName, LastWriteTime, Length
}

Write-Host "`n[*] Triage complete. If any [Red] items appeared, isolate the host and begin IR procedures." -ForegroundColor Cyan