Attackers hijack HBO Max’s Reddit account for 48-hour malvertising blitz
Attackers hijacked HBO Max's verified Reddit account to push 108 ClickFix infostealer ads delivering AMOS, MacSync, and crypto clippers.
Threat actors compromised the verified u/hbomax Reddit account and ran 108 ClickFix malvertising ads in 48 hours as part of the PasteSwitch operation, analyzed by Hudson Rock and ADAMnetworks. macOS victims received curl-to-zsh payloads (MacSync, AMOS Helper, fake Ledger/Trezor/Exodus wallets harvesting BIP39 seed phrases); Windows users got Amatera via mshta and PowerShell loaders. Clipper C2 addresses are stored in Binance Smart Chain smart contracts, with 36 mainnet changes observed between March and July 2026.
- Compromised verified HBO Max Reddit account pushed 108 ClickFix ads in 48 hours
- Cross-platform operation spans MacSync, AMOS, Amatera, fake wallets, and crypto clippers
- Wallet apps harvest 12/24-word BIP39 recovery phrases for direct crypto theft
- C2 hosted on Binance Smart Chain contracts, rotating 36 times March-July 2026
- Reddit has paused the ads and secured the account
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | clean-disk-guide.com | oke down into 15 ads for a fake macOS disk utility at apple.clean-disk-guide[.]com and 11 for other developer tools at code-desktop[.]com. O |
| domain | code-desktop.com | .clean-disk-guide[.]com and 11 for other developer tools at code-desktop[.]com. One entry point into a larger system The HBO Max ads wer |
| domain | codex-craft.com | -macos[.]com. Another 36 posed as OpenAI Codex, pointing to codex-craft[.]com. The rest broke down into 15 ads for a fake macOS disk ut |
| domain | hbomax-macos.com | s, 46 used an HBO Max lure, split between hbomaxx[.]app and hbomax-macos[.]com. Another 36 posed as OpenAI Codex, pointing to codex-craf |
| domain | hbomaxx.app | id . Of the 108 ads, 46 used an HBO Max lure, split between hbomaxx[.]app and hbomax-macos[.]com. Another 36 posed as OpenAI Codex, |
| domain | hbomaxx.us | HBO Max subreddits,” wrote the user. Clicking the ad led to hbomaxx[.]us, “which looks somewhat legitimate, and has a join button |
From the original article
3 min read at helpnetsecurity.com
Attackers compromised the verified official HBO Max Reddit account, u/hbomax, and used its trusted advertising status to launch a ClickFix campaign targeting macOS and Windows devices with information-stealing malware. Screenshot of the fraudulent ad (Source: Alex Cutts) ClickFix has been rising in popularity among cybercriminals.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.