The official HBO Max Reddit account was compromised and used to run more than 100 malicious ads that delivered ClickFix attacks targeting Windows and macOS users with information-stealing malware.. A Reddit user said they found the ads on Sept. 6 and saw they were posted by u/hbomax, the verified HBO Max account, promoting a macOS app for HBO Max even though the streaming service does not offer a native Mac client..
Users who clicked the ad were sent to a landing page at hbomaxx[.]us with a join or download button. Clicking that button produced instructions telling users to copy and paste a command into Terminal on macOS.. The Reddit user described the prompt as “the classic infostealer/clickfix paste this command to download” and said they tested it in a sandboxed environment without running the executable.
The user said they believed the Reddit account had been compromised.. Three days later, Reddit paused the ads. A platform administrator said Reddit’s safety and security teams were investigating the incident..
Warner Bros. Discovery, HBO Max’s parent company, did not immediately respond to questions about the account takeover or how the Reddit account was hijacked.. Hudson Rock and ADAMnetworks said in separate reports that the HBO Max account hijacking was part of a 48-hour malvertising campaign they named PasteSwitch.
The researchers said the operation pushed 108 distinct ads using multiple software-themed lures.. The campaign delivered malware tailored to the victim’s operating system, the researchers said. Payloads included infostealers, malware loaders, cryptocurrency clippers, and fake cryptocurrency wallet applications..
Hudson Rock said PasteSwitch deployed either AnimateClipper or ZigClipper and used Binance Smart Chain contracts as a fallback command-and-control mechanism. “Between March and July 2026, researchers observed 36 mainnet changes executed by the same attacker controller address,” Hudson Rock said..
“Because the C2 domain is hosted directly on the blockchain, the infrastructure demonstrates dynamic resilience, allowing the threat actors to easily rotate burned domains,” Hudson Rock said.. The researchers said 46 of the 108 ads used HBO Max as a lure, sending users to hbomaxx[.]app or hbomax-macos[.]com.
Another 36 used an OpenAI Codex theme with codex-craft[.]com, while 15 posed as a macOS disk utility at apple.clean-disk-guide[.]com and 11 used other developer-tool lures at code-desktop[.]com.. “The campaign proves once again why trusted distribution channels are becoming prime targets for infostealer delivery,” Hudson Rock co-founder and CTO Alon Gal said in a LinkedIn post..
Featured image credit. Tags: hbo maxReddit
