Cybercriminals hijacked HBO Max’s verified Reddit account and used it to run malicious advertisements targeting Windows and macOS users with ClickFix malware.
The campaign, linked to a wider operation dubbed PasteSwitch, used trusted branding and fake software downloads to convince victims to manually run malicious commands.
Reddit paused the ads and began an internal investigation after community members reported the activity.
The campaign was first highlighted by Alex Cutts in the r/cybersecurity subreddit after they spotted an official-looking Reddit ad posted by the verified u/hbomax account. The ad promoted a native HBO Max application for macOS, despite no standalone macOS app being available.
Users who clicked the ad were redirected to a convincing fake HBO Max website, including domains such as hbomaxx[.]us.
Instead of downloading an application, the page displayed a ClickFix prompt. It instructed visitors to copy and paste a command into Terminal on macOS or a Windows Run dialog.
HBO Max ClickFix Hijack
ClickFix attacks do not always rely on a traditional malicious download. Instead, they manipulate users into running the code themselves.
This approach can evade browser warnings and security controls because the victim manually launches the command.
Joint research by Hudson Rock and ADAMnetworks found that the HBO Max incident was part of a larger cross-platform malware delivery system named PasteSwitch.
Attackers reportedly used the compromised Reddit account for about 48 hours and published 108 malicious ads.
The ads used several lures beyond HBO Max, including fake AI developer tools, coding applications, disk-cleaning utilities, and macOS system tools.
The operators quickly switched domains when earlier infrastructure was detected or removed. PasteSwitch identifies a visitor’s operating system and serves a different infection chain for macOS or Windows.
The central action remains the same: a victim pastes an attacker-controlled command that downloads or runs the next stage. On macOS, researchers observed commands using curl and zsh to retrieve malware.
Payloads included MacSync, an information stealer capable of collecting browser credentials, Telegram information, Apple Notes, saved passwords, and browser profile data.
Another branch used AMOS-related helpers, which can run native components and establish persistent tasking through attacker-controlled servers.
The operation also delivered fake Ledger, Trezor Suite, and Exodus wallet applications. These programs were designed to steal 12- or 24-word cryptocurrency recovery phrases from victims.
Windows users were routed to a separate chain involving mshta and PowerShell. One observed payload, called InstallFix, used an MP3/HTA polyglot file to execute malicious code, create scheduled tasks, and weaken security protections.
Later stages reportedly loaded the Amatera information stealer directly into memory, reducing the number of malicious files written to disk, hudsonrock said.
Researchers also found deceptive TLS behavior in the Windows branch. Amatera connected to a malicious IP address while presenting facebook.com in TLS SNI and HTTP fields, potentially misleading basic network-monitoring systems.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
