HBO Max Reddit Account Hacked to Push ClickFix Malware Ads

The official HBO Max Reddit account was hacked and used to serve malicious ads for 48 hours. The goal: distribute an infostealer malware strain to Windows and macOS users by abusing the ClickFix technique. Here’s what we know.

It all started with a Reddit user, Alex Cutts, who noticed an ad that seemed too good to be true. That is often the case when an ad is malicious: the offer is meant to be enticing. Yet at first glance, it was reassuring, since the ad was signed by u/hbomax, the verified account of Warner Bros Discovery’s streaming platform. The problem is that it promoted a native HBO Max app for macOS, and no such app exists.

The user shared the discovery on r/cybersecurity: "The ad sends you to hbomaxx[.]us, which looks fairly legitimate, with a button to sign up or download. When you click it, you get the classic ‘paste this command to download’ infostealer and ClickFix prompt.", he wrote. The ad is actually pretty well made (thanks, AI).

As a reminder, ClickFix is a social engineering technique I have already covered several times. In a nutshell, the idea is this: under the pretext of fixing an error, validating a CAPTCHA, or installing software, the victim copies and pastes a command into the Terminal, PowerShell, or the Run dialog on their PC. In other words, the user infects their own machine.

Here, the hbomaxx[.]us page is a copy of the official HBO Max website. The download button did not trigger any download; instead, it displayed a pop-up asking the user to paste a command into the Terminal.

108 ads in 48 hours, and not just for HBO Max

A report published by Hudson Rock takes a closer look at this malicious campaign and gives us more details. What we learn is that over 48 hours, the u/hbomax account allegedly served 108 separate malicious ads. "The attackers extracted maximum value from the verified status of the account, rapidly switching domains once one was burned.", Hudson Rock summarizes. The number is high, but not surprising: the attackers wanted to move fast and make a big impact, especially before HBO Max noticed.

And in reality, the HBO Max app was not the only lure used by the attackers:

• 46 ads pointed to hbomaxx[.]app and hbomax-macos[.]com (streaming).
• 47 ads targeted developers with fake AI tools, via codex-craft[.]com and code-desktop[.]com.
• 15 ads promoted a macOS disk-cleaning utility hosted on apple.clean-disk-guide[.]com.

This official account was therefore used to push ads that had nothing to do with HBO Max. Following user reports, Reddit took the necessary steps to pause the malicious ads. However, it is still unknown how the attackers gained access to the HBO Max Reddit account (weak password, infostealer, etc...).

PasteSwitch: a delivery system that adapts the malware to the victim

Hudson Rock’s report also reveals that the HBO Max case is part of a broader campaign called PasteSwitch.

"We can confirm that this incident is part of a large-scale, cross-platform distribution operation that we call PasteSwitch. This operation spans macOS stealers, Windows loaders, deceptive TLS tactics, and contract-controlled crypto clippers.", the report says.

The name was not chosen by chance, because here is how it works: the victim pastes a command provided by the attacker, and the backend then selects the campaign best suited to that victim. As a result, the payload and monetization method are determined based on the visitor and their system.

On macOS, the command retrieves a script with curl and runs it in zsh. Three payloads were observed by researchers:

• MacSync. An infostealer I introduced to you in December 2025, when an Apple-signed MacSync variant bypassed Gatekeeper. It steals browser credentials, Telegram data, Apple Notes, and macOS passwords.
• AMOS Helper. A native binary that persists in a directory named .com.apple.accountsd and registers the Mac with a command-and-control (C2) server.
• Fake wallet apps. Copies of Ledger, Trezor Suite, and Exodus designed to capture recovery phrases.

On Windows, PasteSwitch uses mshta and PowerShell to load the Amatera infostealer directly into memory, leaving no traces on the PC’s disk. The Amatera malware then contacts its C2 server by IP while presenting facebook.com in the TLS SNI. What is that for? Simply to fool network traffic analysis systems into thinking the connection is headed to Facebook... Clever.

HBO Max has now regained control of its Reddit account, and everything is back to normal.

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio