Hackers Hijack HBO Max Reddit Account to Push ClickFix Malware Ads
Summary
Researchers say attackers hijacked HBO Max’s verified Reddit account to post 108 malicious ads in about 48 hours, directing users to ClickFix attacks and malware targeting Windows and macOS. Reddit paused the ads; how the account was accessed is unclear.
Key points
- Hudson Rock and ADAMnetworks say the verified u/hbomax account posted 108 malicious ads over about 48 hours.
- The ads directed users to deceptive sites and used ClickFix instructions to trick them into running commands in Windows tools or macOS Terminal.
- Researchers linked the activity to PasteSwitch, which they say switches campaigns, platforms, payloads, and cryptocurrency theft methods.
- Reported payloads included MacSync, AMOS helper, Amatera Stealer, and clipboard hijackers AnimateClipper and ZigClipper; fake Ledger, Trezor Suite, and Exodus apps sought wallet recovery phrases.
- One fake HBO Max site, hbomaxx[.]us, prompted visitors to paste a Terminal command rather than download an app.
- Reddit paused the ads and referred them to its Security and Safety teams. How attackers accessed the account and whether other HBO or Warner Bros. Discovery systems were affected remain unclear.
Article Details
- Victim Organization
- HBO Max
- Incident Type
- Compromise of HBO Max’s verified Reddit account to run malicious advertisements directing users to ClickFix attacks and malware.
- Operational Impact
- The compromised account was used to post 108 malicious advertisements over about 48 hours. Reddit paused the advertisements after they were reported. The article does not report disruption to HBO Max services or systems.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | apple[.]clean-disk-guide[.]com | Domain promoted by malicious advertisements for fake macOS utilities. |
| DOMAIN | code-desktop[.]com | Domain promoted by malicious advertisements in the campaign. |
| DOMAIN | codex-craft[.]com | Fake AI and developer site promoted by malicious advertisements in the campaign. |
| DOMAIN | ember-bridge[.]com | Malware-delivery infrastructure used in the PasteSwitch operation; a command in the attack fetched a setup script from this domain. |
| DOMAIN | hbomax-macos[.]com | Domain promoted by malicious advertisements for a fake HBO Max macOS application. |
| DOMAIN | hbomaxx[.]app | Domain used by malicious advertisements in the campaign, according to researchers. |
| DOMAIN | hbomaxx[.]us | Fake HBO Max site used to direct visitors to a ClickFix command for malware installation. |
People
Malware
Products
ExodusPayloads included MacSync, AMOS helper, Amatera Stealer, and fake Ledger, Trezor Suite, and Exodus apps.HBO MaxHackers hijacked HBO Max’s official Reddit account to run malicious ads that led users to ClickFix pages and infected Windows and macOS devices with information-stealing malware.LedgerPayloads included MacSync, AMOS helper, Amatera Stealer, and fake Ledger, Trezor Suite, and Exodus apps.macOSHackers hijacked HBO Max’s official Reddit account to run malicious ads that led users to ClickFix pages and infected Windows and macOS devices with information-stealing malware.Microsoft WindowsHackers hijacked HBO Max’s official Reddit account to run malicious ads that led users to ClickFix pages and infected Windows and macOS devices with information-stealing malware.RedditHackers hijacked HBO Max’s official Reddit account to run malicious ads that led users to ClickFix pages and infected Windows and macOS devices with information-stealing malware.Trezor SuitePayloads included MacSync, AMOS helper, Amatera Stealer, and fake Ledger, Trezor Suite, and Exodus apps.
Tools
mshta.exeOn Windows systems, PasteSwitch has been observed displaying instructions that cause victims to execute commands using mshta and PowerShell.PowerShellknown as ClickFix, which tricks users into copying and pasting malicious commands into Windows Run, PowerShell, or macOS Terminal while pretending to fix an error, verify a CAPTCHA, or install legitimate software.Terminalwhich tricks users into copying and pasting malicious commands into Windows Run, PowerShell, or macOS Terminal while pretending to fix an error, verify a CAPTCHA, or install legitimate software.
Industries
CryptocurrencyThe campaign, linked by researchers to PasteSwitch, also pushed fake AI tools, developer software, and cryptocurrency wallet apps to steal credentials and wallet recovery phrases.StreamingWhile some of the advertisements pushed by the HBO Max account impersonated the streaming service, others promoted fake AI tools, developer software, and macOS utilities.