How a Hijacked HBO Max Reddit Account Fueled a ClickFix Malware Campaign

A trusted account can make a malicious ad look routine. In this case, researchers said attackers hijacked the verified u/hbomax Reddit account and used it to distribute ClickFix ads that led Windows and macOS visitors toward information-stealing malware. The incident appears to be an abuse of the account and its advertising access—not proof of a breach of HBO Max or Warner Bros. Discovery infrastructure. 1921

What happened

Over about 48 hours, the compromised account ran 108 malicious advertisements, according to researchers cited in reporting on the incident. The ads impersonated HBO Max as well as AI/developer tools and macOS utilities, and researchers linked the activity to a broader operation they called PasteSwitch. 1921

The campaign was surfaced by Reddit users and investigated by Hudson Rock and ADAMnetworks, with other researchers contributing analysis. Reddit said it had temporarily halted the affected advertisements and was investigating with its Security and Safety teams. 2129

How the ClickFix lure worked

ClickFix does not need a browser exploit. Instead, it persuades the target to execute a command themselves:

1. A user clicks an ad and lands on a counterfeit streaming, software, or troubleshooting page.
2. The page displays a convincing error, verification check, fake CAPTCHA, or instruction to fix a supposed problem.
3. It tells the visitor to copy and paste a command into Terminal on macOS or the Run dialog, PowerShell, or another command interface on Windows.
4. Running that command starts the attacker’s malware chain. 21419

This approach is effective because it combines familiar brands, apparently verified advertising, and a mundane troubleshooting task. The malicious action is authorized by the user, rather than arriving as an obvious executable download or exploiting a software vulnerability. 114

What PasteSwitch delivered

Researchers described PasteSwitch as a flexible, cross-platform delivery operation rather than a single static malware campaign. Its landing pages and commands could select different content based on operating system and change destinations or payloads over time. 182127

macOS: MacSync, AMOS-related components, and crypto lures

The macOS branch was reported to deliver MacSync and AMOS Helper-related stealer components. ClickFix campaigns using fake macOS utilities and Terminal instructions have also been documented by Microsoft, illustrating how a pasted command can launch an obfuscated loader on a Mac. 1811

Researchers associated with the HBO Max incident also reported wallet-themed lures impersonating Ledger, Trezor, and Exodus. The operation included cryptocurrency clipboard-hijacking behavior: malware can watch for a copied wallet address and replace it with an attacker-controlled address before a transfer is made. 2127

Windows: an MP3-looking loader and Amatera Stealer

The Windows delivery chain reportedly used a polyglot file presented as an MP3 but capable of acting as an HTA loader, ultimately leading to Amatera Stealer. Amatera—also called ACR or AcridRain Stealer—is a Windows credential and information stealer that has appeared in ClickFix, fake-verification, malvertising, and multi-stage loader campaigns. 1824

For either operating system, the potential consequence is broader than a single password: infostealers can target browser credentials, active sessions, stored data, and cryptocurrency-wallet information. 418

Why blockchain-backed routing matters

Researchers tied PasteSwitch to infrastructure that used BNB Smart Chain smart contracts as dead-drop-style routing. The reported operation rotated through 36 domains between March and July 2026. 21

This resembles a wider ClickFix pattern in which compromised sites retrieve instructions or payload-routing data from BNB Smart Chain contracts. Because operators can alter on-chain instructions without changing every compromised site, defenders cannot rely solely on blocking one URL or file hash. 33639

What remains unknown

The central unanswered question is how attackers gained control of the HBO Max Reddit account or its advertising access. Public reporting has not established whether the cause was stolen credentials, a stolen session token, weak or bypassed multifactor authentication, third-party access, or another route. 1921

There is also no reliable public accounting of ad impressions, clicks, command execution, infections, financial losses, or affected users. Seeing an ad was not enough to become infected; the victim still had to follow the page’s instructions and run the command. Nor is there public evidence that the incident reached Warner Bros. Discovery corporate, customer, production, or streaming systems. 1921

Why this case matters beyond HBO Max

ClickFix has become a widely used social-engineering technique across both Windows and macOS. Microsoft has warned that campaigns exploit people’s instinct to resolve minor technical problems, including fake CAPTCHA and verification prompts; separate reporting identified more than 5,400 compromised websites serving ClickFix lures with blockchain-based payload infrastructure. 143

The durable takeaway is not to trust a command simply because it appears after an ad, on a familiar-looking website, or behind a verification prompt. Stop if any page asks you to paste text into Terminal, Run, PowerShell, or Windows Terminal. Close the page and obtain software or support instructions directly from the vendor’s official site. 214