HBO Max Reddit Account Hijacked for Widespread Malvertising Campaign
The official HBO Max Reddit account was compromised to distribute over 100 malicious ads pushing ClickFix attacks with information-stealing malware for Windows and macOS.
The official Reddit account for HBO Max was hijacked and used in a significant malvertising campaign that pushed over 100 malicious ads, ultimately delivering ClickFix attacks laden with information-stealing malware targeting both Windows and macOS users. The compromise was first noticed on September 6th by a Reddit user who observed ads authored by the verified u/hbomax account, promoting a non-existent HBO Max macOS application. Clicking these ads led users to a convincing-looking landing page, hbomaxx[.]us, which prompted them to download an application. This download process involved instructing users to copy and paste commands into their system's Terminal, a classic tactic for delivering infostealers.
Researchers from Hudson Rock and ADAMnetworks analyzed the campaign, which they've named "PasteSwitch." They described it as a "massive 48-hour malvertising blitz" that utilized a variety of lures beyond just HBO Max. The attackers deployed 108 distinct ads, employing themes related to developer tools, disk cleaners, and AI, including fake advertisements for OpenAI Codex. The payloads delivered by PasteSwitch are diverse, encompassing infostealers, malware loaders, cryptocurrency clippers, and fraudulent cryptocurrency wallet applications.
For its command-and-control (C2) infrastructure, the PasteSwitch campaign demonstrated remarkable resilience by leveraging Binance Smart Chain (BSC) contracts. This blockchain-based approach allowed the attackers to dynamically fetch their C2 domains, making it difficult to disrupt their operations by simply blocking known domains. Between March and July 2026, researchers observed 36 mainnet changes executed by the same attacker-controlled address, highlighting the adaptability of this C2 method. By hosting the C2 domain directly on the blockchain, the infrastructure achieved dynamic resilience, enabling threat actors to easily rotate compromised domains.
While 46 of the 108 ads used the HBO Max lure, directing users to domains like hbomaxx[.]app or hbomax-macos[.]com, other lures were also prominent. Thirty-six ads focused on OpenAI Codex, leading to codex-craft[.]com. Additionally, 15 ads promoted fake macOS disk utilities via apple.clean-disk-guide[.]com, and 11 others used developer tool lures, pointing to code-desktop[.]com.
Following the discovery, Reddit temporarily paused the malvertising ads and initiated an investigation. HBO Max's parent company, Warner Bros. Discovery, had not immediately responded to inquiries regarding the account takeover, including details on how the compromise occurred or who was responsible. The incident underscores the growing threat of malvertising and the exploitation of trusted online platforms for malicious purposes.
The PasteSwitch campaign highlights two significant trends in cybercrime: the continued reliance on social engineering tactics like ClickFix attacks, and the increasing sophistication of malvertising operations. The use of a compromised, high-profile Reddit account demonstrates the attackers' strategy of leveraging established trust to reach a wider audience. The campaign's success in delivering varied malware payloads, including cryptocurrency clippers and infostealers, indicates a multi-faceted approach to monetization.
This incident serves as a stark reminder of the importance of verifying the authenticity of online advertisements and software downloads, even when they appear to originate from legitimate sources. The dynamic C2 infrastructure employed by PasteSwitch also points to the evolving tactics threat actors are using to evade detection and maintain operational security, making attribution and takedown efforts increasingly challenging for cybersecurity professionals.
This new article provides further technical details on the PasteSwitch operation, including the specific domains used for lures and the various payloads delivered on macOS and Windows. It highlights the deceptive use of TLS traffic mimicking facebook.com and the mechanism by which clipper malware replaces cryptocurrency addresses, offering a deeper understanding of the campaign's infrastructure and execution methods.
This new report details the specific malware families distributed, including MacSync, AMOS Helper, and fake wallet applications on macOS, and Amatera Stealer on Windows. It further elaborates on the ClickFix attack chain, noting the use of curl | zsh on macOS and MSHTA/PowerShell on Windows, and highlights the use of AnimateClipper and ZigClipper as persistent clipboard replacement tools with blockchain-hosted C&C infrastructure.
This new report details the "PasteSwitch" operation, revealing that the compromised HBO Max Reddit account was used to distribute 108 distinct ClickFix ads over a 48-hour period. The campaign pivoted quickly between domains, employing lures for HBO Max, OpenAI Codex, and fake macOS utilities, and utilized blockchain-hosted command and control infrastructure for dynamic resilience.
This new report from Malwarebytes Labs provides further technical details on the PasteSwitch operation, including the specific macOS and Windows infostealers deployed, such as MacSync, AMOS, and Amatera. It also highlights the ClickFix technique's prevalence, noting it was responsible for over half of malware loader activity in 2025, and offers additional user-facing mitigation advice beyond basic vigilance.