Hacked HBO Max Reddit Ads Pushed Malware

A verified Reddit account belonging to HBO Max was used to push 108 malicious advertisements over a 48-hour window, according to reporting by SecurityWeek. The ads led users to a fake HBO Max download page that delivered malware through a ClickFix prompt, in a campaign tracked as PasteSwitch.

The operation is notable because it relied on a trusted brand account and a technique that asks the user to run a command themselves, rather than exploiting a software flaw.

PasteSwitch Targets a Verified Account

SecurityWeek reported that attackers compromised the official HBO Max account on Reddit and used it in a malvertising campaign leading to a ClickFix landing page. During the 48-hour window, the attackers pushed 108 malicious advertisements across five lure groups as part of the PasteSwitch campaign.

Using the verified u/hbomax account, the threat actors targeted both macOS and Windows users. They aggressively promoted a native macOS application for HBO Max, which does not exist.

Clicking the malicious ads led users to hbomaxx[.]us, a page mimicking the official HBO Max site that also contained a download button.

Reddit was notified of the malicious activity associated with the official HBO Max account and immediately suspended the ads.

ClickFix Asks Users to Run Code

The fake download page used a ClickFix prompt as its delivery mechanism. According to the security firm ADAMnetworks, the download button opened a prompt that instructed visitors to copy a command, open Terminal, paste the command, and run it.

“The download button opened a ClickFix prompt that told the visitor to copy a command, open Terminal, paste the command, and run it. This transferred execution from the browser to a trusted system utility under the victim’s control,” ADAMnetworks explains.

— ADAMnetworks

The technique places the final step in the user’s hands, with the browser handing off execution to a system utility already installed on the machine.

macOS Payloads and Stolen Data

On macOS, the attack relied on curl | zsh commands to deliver malware such as MacSync, AMOS Helper, fake wallet applications, and other malicious code, according to SecurityWeek. The goal was to steal users’ information, including their credentials, messages, browser information, and cryptocurrency wallet information, and to gain persistent access to their machines.

The use of curl | zsh means the command pulls and runs code in a single step. The malware families named in the report — MacSync, AMOS Helper, and fake wallet applications — point to a mix of data theft and credential grabbing on the macOS side.

Windows Chain Uses MSHTA and PowerShell

On Windows, the attack relied on MSHTA and PowerShell to deliver the Amatera Stealer and achieve persistence, according to the report. The malware was configured for manual credential validation and would bypass network telemetry by spoofing Facebook connections to hide its command-and-control (C&C) communication.

Manual credential validation suggests a human operator is involved in checking stolen credentials rather than an automated pipeline. The spoofing of Facebook connections is described in the report as a way to hide C&C traffic.

Clipboard Stealers Swap Crypto Addresses

The PasteSwitch campaign also used AnimateClipper and ZigClipper as persistent clipboard replacement tools to swap cryptocurrency addresses when users attempted to make a transaction, HudsonRock notes. The two tools are described as persistent clipboard replacement utilities tied to the campaign.

According to the security firms, the clipboard stealers use a C&C hosted on the blockchain. The infrastructure was likely set up over a year ago and has been used in attacks since early 2026.

Timeline and Technical Scope

The reporting lays out a set of concrete figures for the PasteSwitch operation. The campaign ran for 48 hours, used 108 malicious advertisements, and spread them across five lure groups. The fake download domain was hbomaxx[.]us. On the platform side, the lure groups and ad volume show how the operation was structured to reach both macOS and Windows users within a short span.

• 48 hours — duration of the malicious ad campaign
• 108 malicious advertisements pushed across five lure groups
• hbomaxx[.]us — the fake HBO Max download domain
• five lure groups used to organize the ads
• infrastructure likely set up over a year ago, used in attacks since early 2026

Reddit Suspends the Ads

Reddit was notified of the malicious activity associated with the official HBO Max account and immediately suspended the ads, according to the report. The account itself was the official HBO Max presence on the platform.

SecurityWeek has emailed Warner Bros., which owns HBO Max, for a statement on the hack and will update the article if the company responds.

What the Reporting Leaves Open

The source material does not say how the HBO Max Reddit account was compromised, how many users clicked the ads, or how many machines were infected. It also does not say whether any automated ad review flagged the activity before Reddit was notified, or whether the account has since been recovered.

The report attributes the ClickFix prompt details to ADAMnetworks and the clipboard stealer findings to HudsonRock, both of which reviewed the campaign. The malware names, the fake domain, and the ad counts are the concrete technical elements carried in the source.

Why It Matters

For readers, the PasteSwitch campaign illustrates a delivery model that does not require a software vulnerability in macOS or Windows. It used a verified brand account to place ads and then asked users to run a command themselves. That means the attack surface includes user trust in a familiar account and a familiar download page, not just unpatched software.

If you saw or clicked the ads, the report says the macOS payloads were built to take credentials, messages, browser data, and cryptocurrency wallet information, and to keep access to the machine. The Windows payload, Amatera Stealer, was configured for manual credential validation. The clipboard stealers add a separate risk: a victim who copies a wallet address and pastes it into a transfer field could end up sending funds to an attacker-controlled address. That combination of credential theft, persistence, and clipboard manipulation is broader than a single stolen password.

For platforms and brands, the episode points to the role of account verification and ad review. The ads ran under a verified account for 48 hours before Reddit was notified and suspended them. The reporting does not say whether automated checks caught the activity first. The blockchain-hosted C&C infrastructure, likely set up over a year ago and used in attacks since early 2026, suggests the tools behind PasteSwitch were not built for a single short campaign.

These are inferential points drawn from the reported facts, not claims from the source. The core takeaway supported by the reporting is practical: a verified account and a familiar brand name are not proof that a download is safe. The ClickFix pattern — copy a command, open a terminal, paste it, run it — is the step that hands control to the attacker. Recognizing that pattern, regardless of which company’s name is on the ad, is the part of this story that carries over to the next campaign.