Cybercriminals Hijack HBO Max’s Verified Reddit Account for Malware Distribution
In a significant breach, cybercriminals managed to compromise the verified Reddit account of HBO Max, utilizing it to distribute malware through 108 malicious advertisements over a span of approximately 48 hours. This alarming incident, uncovered by cybersecurity researchers at Hudson Rock, highlights a growing trend wherein attackers exploit the trust associated with well-known brands to lure unsuspecting victims.
The attackers leveraged the credibility of HBO Max’s corporate account to disseminate deceptive promotions. They advertised bogus artificial intelligence tools, developer software, and macOS utilities, deliberately designed to make victims feel secure and lower their defenses. The research revealed that Reddit administrators acted swiftly to mitigate the situation by pausing the ads and initiating a thorough security investigation.
Unbeknownst to many users, these malicious advertisements directed them to fake websites that closely mimicked the official HBO platform. These impersonating sites falsely claimed to offer a native HBO Max application for macOS, alongside promotional downloads that purportedly provided users with additional features. Instead of delivering legitimate software, the sites instructed users to open the Terminal on macOS or the Run dialog and PowerShell on Windows. There, victims were prompted to paste and execute specific commands, a method commonly referred to as ClickFix.
ClickFix techniques are particularly pernicious as they disguise harmful instructions as common technical steps. This approach includes misleading activities such as error correction, CAPTCHA completion, and identity verification—all of which can seem legitimate to the average user. Researchers from ADAMnetworks have named this malicious operation PasteSwitch, noting that its underlying infrastructure customizes payloads based on the visitor’s device and the type of lure that piques their interest.
When examining the specifics of the malware distributed, the findings revealed that macOS users were targeted with infostealers such as MacSync and AMOS. These harmful programs are designed to extract sensitive information from compromised systems, including browser credentials, Telegram chat data, Apple Notes content, saved passwords, and even cryptocurrency wallet recovery phrases. Additionally, Windows users faced risks from the Amatera infostealer, which is particularly dangerous due to its ability to operate in memory, making it harder to detect.
Compounding these threats, the operations have also deployed cryptocurrency clipboard hijackers. These malicious tools monitor copied wallet addresses, replacing them with addresses controlled by the attackers before any actual transactions are processed. This represents a severe risk for individuals involved in cryptocurrency, as it could lead to substantial financial losses.
The rise of ClickFix attacks has been notable, with reports indicating that they accounted for over half of all malware loader activity in 2025. This technique’s success is largely due to the evolving nature of the campaigns, as they continuously integrate new approaches to deceive users and develop different commands to evade detection. While macOS versions Tahoe 26.4 and later may issue warnings when users attempt to paste text into the Terminal, this protective measure is not universally effective and should not be solely relied upon for security.
Security experts strongly advise users to exercise caution with all advertisements, regardless of whether they originate from verified accounts. They recommend that users visit official company websites directly rather than downloading software through ads, which often conceal risks. Moreover, executing commands copied from websites, emails, or messages should never be done without thorough verification of the source and a comprehensive understanding of the command’s function.
Organizations are urged to implement real-time anti-malware solutions that include web protection components. Additionally, educating employees about the ever-evolving landscape of attack techniques is essential for maintaining robust cybersecurity. In response to the PasteSwitch operation, cybersecurity firm Malwarebytes has introduced blocks for ember-bridge.com, a domain associated with the campaign’s infrastructure, thereby enhancing its protective measures.
This incident serves as a stark reminder of the relentless nature of cyber threats and underscores the importance of vigilance in an increasingly complex digital landscape. Organizations and users alike must remain proactive in their efforts to secure their information from the malicious intents of cybercriminals.