Attackers compromised the verified Reddit account of HBO Max to distribute 108 deceptive advertisements over a 48-hour period. Of these ads, 46 were disguised as HBO Max content, while others mimicked various software tools to lure users to fraudulent websites.
The campaign utilized a social-engineering method known as ClickFix, which prompts users to manually execute malicious commands in Terminal, PowerShell, or the Run dialog box. This technique bypasses traditional antivirus software by treating the user-initiated actions as authorized.
Once executed, the malware installed infostealers, such as MacSync and AMOS, designed to harvest browser credentials, passwords, and cryptocurrency wallet recovery phrases. Additionally, the software included clipboard hijackers that replace copied wallet addresses with those controlled by attackers.
Security researchers from Hudson Rock and ADAMnetworks linked the incident to a broader, ongoing operation called PasteSwitch. This campaign has been active since early 2026 and utilizes a flexible infrastructure to deploy deceptive lures across multiple platforms.
Reddit eventually suspended the malicious advertisements after users reported the compromised account. The incident highlights the risks of verified accounts being used to facilitate large-scale phishing and malware distribution.
