ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cyber Security Newspublished ()ingested Tushar Subhra Dutta
Part of a story covered by 7 sources: “HBO Max's verified Reddit account hijacked to run 108 ClickFix malware ads” — merged summary and timeline →

Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads

highMalware exploited in the wildimportance 63
AI summary · glm-5.3

Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.

HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.

  • Verified u/hbomax account pushed 108 ClickFix ads over 48 hours across five lure domains
  • macOS chains deliver AMOS stealers; Windows InstallFix uses mshta/PowerShell to load Amatera in memory
  • AnimateClipper and ZigClipper replace copied crypto addresses with attacker wallets
  • C2 domains rotated via Binance Smart Chain contracts; deceptive TLS uses facebook.com SNI
Read the original
ATT&CK T1204 User Execution T1059.004 Unix Shell T1059.001 PowerShell T1562.001 Impair Defenses T1115 Clipboard Data
Tagsclickfixmalvertisingamosinfostealerclipboard-hijackerredditsocial-engineering

Indicators of compromiseAll →

TypeIndicatorContext
domainaforvm.com; verse-18[.]com; lakhov[.]com; mpasvw[.]com; ouilov[.]com; aforvm[.]com AMOS helper and tasking domains Domain loop-lumen[.]com;
domainaidevmaster.com]com; pressureulcerlawyer[.]com; lalandscapelighting[.]com; aidevmaster[.]com; pinescope11[.]com; dogtrainersgeorgia[.]com; denverplumb
domainalfredaps.comltration Domain filequanticore[.]com; filesiriuscore[.]com; alfredaps[.]com; hbomaxx[.]us; hbomax-macos[.]com; bright-links[.]com; co
domainapplediag.comm; opendisplay[.]us Provisioning-linked lure domains Domain applediag[.]com; getnova[.]top; nova-desk[.]top; nova-fix[.]top; nova-hub
domainarkypc.comhbubagent[.]com MacSync delivery and control domains Domain arkypc[.]com; harbor-29[.]com; fern-plume[.]com; node-slate[.]com; gro
domainbasequill9.comClick-tracking domains Domain press29[.]com; leaf68[.]com; basequill9[.]com; perchframe15[.]com; canvas-35[.]com; pine63[.]com; trekm
domainbeaocnagent.comaesthetics[.]com; marbellaresales[.]com; gatemaden[.]space; beaocnagent[.]com; hbubagent[.]com MacSync delivery and control domains Dom
domainbright-links.come[.]com; alfredaps[.]com; hbomaxx[.]us; hbomax-macos[.]com; bright-links[.]com; codex-notes[.]com; storageprofiler[.]com; cladesktop[.]g
domainbroadwalkindia.comcom; sprieagent[.]com; cosimcagent[.]com; cehamilton[.]com; broadwalkindia[.]com; cim-kolea[.]com; hindustanagency[.]com Teardown and deli
domaincamaligsalvatrefoils.com-command lure domains Domain flutelikelurkerunsinewy[.]com; camaligsalvatrefoils[.]com Click-tracking domains Domain press29[.]com; leaf68[.]com
domaincanvas-35.com[.]com; leaf68[.]com; basequill9[.]com; perchframe15[.]com; canvas-35[.]com; pine63[.]com; trekmesh15[.]com macOS loader-delivery dom
domaincehamilton.com]com; sgaaagent[.]com; sprieagent[.]com; cosimcagent[.]com; cehamilton[.]com; broadwalkindia[.]com; cim-kolea[.]com; hindustanagency[.
domainchatgpt-safepage.comcstoragetips[.]com Provisioning-neighborhood domains Domain chatgpt-safepage[.]com; thepullmanfolkestone[.]com; gigappyworld[.]com; microsof
domaincladesktop.gitlab.ioight-links[.]com; codex-notes[.]com; storageprofiler[.]com; cladesktop[.]gitlab[.]io; cli-desktop[.]com; cli-stack[.]com; homebrwmac-hub[.]c
domainclaude-tools.com]com; hbomaxx[.]app; codex-craft[.]com; code-desktop[.]com; claude-tools[.]com; clean-disk-tools[.]com; opendisplay[.]us Provisioning-li
domainclaud-tips.comcli-guides[.]com; macdeveloperhub[.]com; macfixguide[.]com; claud-tips[.]com; codex-paths[.]com; cmux-lab[.]com; rectangleap[.]com; mu
domainclean-disk-guide.comr-focused ads linked to codex-craft[.]com, 15 tied to apple.clean-disk-guide[.]com, 11 for code-desktop[.]com and six for hbomax-macos[.]com
domainclean-disk-tools.comcodex-craft[.]com; code-desktop[.]com; claude-tools[.]com; clean-disk-tools[.]com; opendisplay[.]us Provisioning-linked lure domains Domain
domaincli-desktop.comtes[.]com; storageprofiler[.]com; cladesktop[.]gitlab[.]io; cli-desktop[.]com; cli-stack[.]com; homebrwmac-hub[.]com; clean-disk-guide[
domaincli-guides.com[.]bike SIC Windows-route domains Domain crisp-paths[.]com; cli-guides[.]com; macdeveloperhub[.]com; macfixguide[.]com; claud-tips[.]c
domaincli-stack.comrofiler[.]com; cladesktop[.]gitlab[.]io; cli-desktop[.]com; cli-stack[.]com; homebrwmac-hub[.]com; clean-disk-guide[.]com Copied-comm
domainclveeragent.comheroestales[.]com; wantsellonline[.]com; papartybus[.]com; clveeragent[.]com; congiagent[.]com; sgaaagent[.]com; sprieagent[.]com; cos
domaincmux-lab.comom; macfixguide[.]com; claud-tips[.]com; codex-paths[.]com; cmux-lab[.]com; rectangleap[.]com; muse-code-ide[.]com; hbomaxx[.]app; c
domaincode-desktop.comraft[.]com, 15 tied to apple.clean-disk-guide[.]com, 11 for code-desktop[.]com and six for hbomax-macos[.]com. The compromised account g
domaincodex-craft.comnts using hbomaxx[.]app, 36 developer-focused ads linked to codex-craft[.]com, 15 tied to apple.clean-disk-guide[.]com, 11 for code-des
domaincodex-notes.com]com; hbomaxx[.]us; hbomax-macos[.]com; bright-links[.]com; codex-notes[.]com; storageprofiler[.]com; cladesktop[.]gitlab[.]io; cli-des
domaincodex-paths.commacdeveloperhub[.]com; macfixguide[.]com; claud-tips[.]com; codex-paths[.]com; cmux-lab[.]com; rectangleap[.]com; muse-code-ide[.]com;
domaincongiagent.comwantsellonline[.]com; papartybus[.]com; clveeragent[.]com; congiagent[.]com; sgaaagent[.]com; sprieagent[.]com; cosimcagent[.]com; ce
domaincosimcagent.com.]com; congiagent[.]com; sgaaagent[.]com; sprieagent[.]com; cosimcagent[.]com; cehamilton[.]com; broadwalkindia[.]com; cim-kolea[.]com;
domaincrisp-paths.comabar55[.]namebright[.]bike SIC Windows-route domains Domain crisp-paths[.]com; cli-guides[.]com; macdeveloperhub[.]com; macfixguide[.]c
domaindenverplumbingandwaterheater.comvmaster[.]com; pinescope11[.]com; dogtrainersgeorgia[.]com; denverplumbingandwaterheater[.]com; restoremental[.]com; glowmedaesthetics[.]com; marbellare
domaindesktop-version.compla[.]com; glrack[.]com Fake wallet delivery domains Domain desktop-version[.]com; oakenfjrod[.]ru Windows staging domains Domain sic180[.]
domaindogtrainersgeorgia.comdscapelighting[.]com; aidevmaster[.]com; pinescope11[.]com; dogtrainersgeorgia[.]com; denverplumbingandwaterheater[.]com; restoremental[.]com;
domainember-bridge.comcom macOS loader-delivery domains Domain weaveridge7[.]com; ember-bridge[.]com; rudder-moss[.]com; wuess[.]com September macOS telemetry
domainfacebook.com3 Amatera direct-to-IP TLS command-and-control server using facebook[.]com SNI IP address 165.22.199[.]85 September macOS telemetry
domainfern-plume.comy and control domains Domain arkypc[.]com; harbor-29[.]com; fern-plume[.]com; node-slate[.]com; grove-12[.]com; verse-18[.]com; lakhov
domainfilequanticore.comss 38.244.158[.]56 AMOS helper /contact exfiltration Domain filequanticore[.]com; filesiriuscore[.]com; alfredaps[.]com; hbomaxx[.]us; hbo
domainfilesiriuscore.comS helper /contact exfiltration Domain filequanticore[.]com; filesiriuscore[.]com; alfredaps[.]com; hbomaxx[.]us; hbomax-macos[.]com; brigh
domainflutelikelurkerunsinewy.com; clean-disk-guide[.]com Copied-command lure domains Domain flutelikelurkerunsinewy[.]com; camaligsalvatrefoils[.]com Click-tracking domains Domain
domaingatemaden.spacental[.]com; glowmedaesthetics[.]com; marbellaresales[.]com; gatemaden[.]space; beaocnagent[.]com; hbubagent[.]com MacSync delivery and
domaingetnova.topus Provisioning-linked lure domains Domain applediag[.]com; getnova[.]top; nova-desk[.]top; nova-fix[.]top; nova-hub[.]top; nova-la
domaingigappyworld.comDomain chatgpt-safepage[.]com; thepullmanfolkestone[.]com; gigappyworld[.]com; microsoftupdater[.]info; gogolfonline[.]com; heroestales
domainglowmedaesthetics.comm; denverplumbingandwaterheater[.]com; restoremental[.]com; glowmedaesthetics[.]com; marbellaresales[.]com; gatemaden[.]space; beaocnagent[.]
domainglrack.comand tasking domains Domain loop-lumen[.]com; umapla[.]com; glrack[.]com Fake wallet delivery domains Domain desktop-version[.]com
domaingogolfonline.comkestone[.]com; gigappyworld[.]com; microsoftupdater[.]info; gogolfonline[.]com; heroestales[.]com; wantsellonline[.]com; papartybus[.]co
domaingrove-12.com.]com; harbor-29[.]com; fern-plume[.]com; node-slate[.]com; grove-12[.]com; verse-18[.]com; lakhov[.]com; mpasvw[.]com; ouilov[.]com
domainhabar55.namebright.bikeakenfjrod[.]ru Windows staging domains Domain sic180[.]com; habar55[.]namebright[.]bike SIC Windows-route domains Domain crisp-paths[.]com; cli
domainharbor-29.comm MacSync delivery and control domains Domain arkypc[.]com; harbor-29[.]com; fern-plume[.]com; node-slate[.]com; grove-12[.]com; vers
domainhbomax-macos.comean-disk-guide[.]com, 11 for code-desktop[.]com and six for hbomax-macos[.]com. The compromised account gave the actors a trusted advert
domainhbomaxx.appblocked. Ads included 40 streaming-themed placements using hbomaxx[.]app, 36 developer-focused ads linked to codex-craft[.]com, 15
domainhbomaxx.usrs run attacker code. The fraudulent landing page hosted at hbomaxx[.]us (Source – HudsonRock) The operators moved quickly as doma
domainhbubagent.comarbellaresales[.]com; gatemaden[.]space; beaocnagent[.]com; hbubagent[.]com MacSync delivery and control domains Domain arkypc[.]com;
domainheroestales.compyworld[.]com; microsoftupdater[.]info; gogolfonline[.]com; heroestales[.]com; wantsellonline[.]com; papartybus[.]com; clveeragent[.]co
domainhomebrwmac-hub.comadesktop[.]gitlab[.]io; cli-desktop[.]com; cli-stack[.]com; homebrwmac-hub[.]com; clean-disk-guide[.]com Copied-command lure domains Domai
domainhoustongaragedoorinstallers.com.]com September macOS telemetry and delivery domains Domain houstongaragedoorinstallers[.]com; pressureulcerlawyer[.]com; lalandscapelighting[.]com; ai
domainlakhov.comme[.]com; node-slate[.]com; grove-12[.]com; verse-18[.]com; lakhov[.]com; mpasvw[.]com; ouilov[.]com; aforvm[.]com AMOS helper and
domainlalandscapelighting.comustongaragedoorinstallers[.]com; pressureulcerlawyer[.]com; lalandscapelighting[.]com; aidevmaster[.]com; pinescope11[.]com; dogtrainersgeorgia
domainleaf68.comtrefoils[.]com Click-tracking domains Domain press29[.]com; leaf68[.]com; basequill9[.]com; perchframe15[.]com; canvas-35[.]com; p
domainloop-lumen.com[.]com; aforvm[.]com AMOS helper and tasking domains Domain loop-lumen[.]com; umapla[.]com; glrack[.]com Fake wallet delivery domains
domainmacdeveloperhub.coms-route domains Domain crisp-paths[.]com; cli-guides[.]com; macdeveloperhub[.]com; macfixguide[.]com; claud-tips[.]com; codex-paths[.]com;
domainmacfixguide.comcrisp-paths[.]com; cli-guides[.]com; macdeveloperhub[.]com; macfixguide[.]com; claud-tips[.]com; codex-paths[.]com; cmux-lab[.]com; rec
domainmacstoragetips.comva-tools[.]top; novastacktips[.]com; remotion-skills[.]com; macstoragetips[.]com Provisioning-neighborhood domains Domain chatgpt-safepage
domainmarbellaresales.comheater[.]com; restoremental[.]com; glowmedaesthetics[.]com; marbellaresales[.]com; gatemaden[.]space; beaocnagent[.]com; hbubagent[.]com Ma
domainmicrosoftupdater.infopage[.]com; thepullmanfolkestone[.]com; gigappyworld[.]com; microsoftupdater[.]info; gogolfonline[.]com; heroestales[.]com; wantsellonline[.]
domainmpasvw.com-slate[.]com; grove-12[.]com; verse-18[.]com; lakhov[.]com; mpasvw[.]com; ouilov[.]com; aforvm[.]com AMOS helper and tasking domai
domainmuse-code-ide.com]com; codex-paths[.]com; cmux-lab[.]com; rectangleap[.]com; muse-code-ide[.]com; hbomaxx[.]app; codex-craft[.]com; code-desktop[.]com; cl
domainnode-slate.comins Domain arkypc[.]com; harbor-29[.]com; fern-plume[.]com; node-slate[.]com; grove-12[.]com; verse-18[.]com; lakhov[.]com; mpasvw[.]c
domainnova-desk.top-linked lure domains Domain applediag[.]com; getnova[.]top; nova-desk[.]top; nova-fix[.]top; nova-hub[.]top; nova-labs[.]top; nova-to
domainnova-fix.topins Domain applediag[.]com; getnova[.]top; nova-desk[.]top; nova-fix[.]top; nova-hub[.]top; nova-labs[.]top; nova-tools[.]top; novas
domainnova-hub.topdiag[.]com; getnova[.]top; nova-desk[.]top; nova-fix[.]top; nova-hub[.]top; nova-labs[.]top; nova-tools[.]top; novastacktips[.]com;
domainnova-labs.topova[.]top; nova-desk[.]top; nova-fix[.]top; nova-hub[.]top; nova-labs[.]top; nova-tools[.]top; novastacktips[.]com; remotion-skills[.
domainnovastacktips.comx[.]top; nova-hub[.]top; nova-labs[.]top; nova-tools[.]top; novastacktips[.]com; remotion-skills[.]com; macstoragetips[.]com Provisioning
domainnova-tools.topesk[.]top; nova-fix[.]top; nova-hub[.]top; nova-labs[.]top; nova-tools[.]top; novastacktips[.]com; remotion-skills[.]com; macstorageti
domainoakenfjrod.ruFake wallet delivery domains Domain desktop-version[.]com; oakenfjrod[.]ru Windows staging domains Domain sic180[.]com; habar55[.]na
domainopendisplay.us-desktop[.]com; claude-tools[.]com; clean-disk-tools[.]com; opendisplay[.]us Provisioning-linked lure domains Domain applediag[.]com;
domainouilov.comgrove-12[.]com; verse-18[.]com; lakhov[.]com; mpasvw[.]com; ouilov[.]com; aforvm[.]com AMOS helper and tasking domains Domain loop
domainpapartybus.comogolfonline[.]com; heroestales[.]com; wantsellonline[.]com; papartybus[.]com; clveeragent[.]com; congiagent[.]com; sgaaagent[.]com; sp
domainperchframe15.commains Domain press29[.]com; leaf68[.]com; basequill9[.]com; perchframe15[.]com; canvas-35[.]com; pine63[.]com; trekmesh15[.]com macOS lo
domainpine63.comcom; basequill9[.]com; perchframe15[.]com; canvas-35[.]com; pine63[.]com; trekmesh15[.]com macOS loader-delivery domains Domain we
domainpinescope11.comlawyer[.]com; lalandscapelighting[.]com; aidevmaster[.]com; pinescope11[.]com; dogtrainersgeorgia[.]com; denverplumbingandwaterheater[.
domainpress29.comm; camaligsalvatrefoils[.]com Click-tracking domains Domain press29[.]com; leaf68[.]com; basequill9[.]com; perchframe15[.]com; canv
domainpressureulcerlawyer.comdelivery domains Domain houstongaragedoorinstallers[.]com; pressureulcerlawyer[.]com; lalandscapelighting[.]com; aidevmaster[.]com; pinescope1
domainrectangleap.com.]com; claud-tips[.]com; codex-paths[.]com; cmux-lab[.]com; rectangleap[.]com; muse-code-ide[.]com; hbomaxx[.]app; codex-craft[.]com; c
domainremotion-skills.comop; nova-labs[.]top; nova-tools[.]top; novastacktips[.]com; remotion-skills[.]com; macstoragetips[.]com Provisioning-neighborhood domains D
domainrestoremental.comgtrainersgeorgia[.]com; denverplumbingandwaterheater[.]com; restoremental[.]com; glowmedaesthetics[.]com; marbellaresales[.]com; gatemade
domainrudder-moss.comivery domains Domain weaveridge7[.]com; ember-bridge[.]com; rudder-moss[.]com; wuess[.]com September macOS telemetry and delivery domai
domainsgaaagent.comcom; papartybus[.]com; clveeragent[.]com; congiagent[.]com; sgaaagent[.]com; sprieagent[.]com; cosimcagent[.]com; cehamilton[.]com; b
domainsic180.comrsion[.]com; oakenfjrod[.]ru Windows staging domains Domain sic180[.]com; habar55[.]namebright[.]bike SIC Windows-route domains Do
domainsprieagent.com]com; clveeragent[.]com; congiagent[.]com; sgaaagent[.]com; sprieagent[.]com; cosimcagent[.]com; cehamilton[.]com; broadwalkindia[.]co
domainstorageprofiler.comle activity IP address 172.236.51[.]169 Origin observed for storageprofiler[.]com gated lure IP address 138.124.93[.]32 AMOS helper /contac
domainthepullmanfolkestone.comsioning-neighborhood domains Domain chatgpt-safepage[.]com; thepullmanfolkestone[.]com; gigappyworld[.]com; microsoftupdater[.]info; gogolfonlin
domaintrekmesh15.com9[.]com; perchframe15[.]com; canvas-35[.]com; pine63[.]com; trekmesh15[.]com macOS loader-delivery domains Domain weaveridge7[.]com; e
domainumapla.comom AMOS helper and tasking domains Domain loop-lumen[.]com; umapla[.]com; glrack[.]com Fake wallet delivery domains Domain desktop
domainverse-18.com[.]com; fern-plume[.]com; node-slate[.]com; grove-12[.]com; verse-18[.]com; lakhov[.]com; mpasvw[.]com; ouilov[.]com; aforvm[.]com A
domainwantsellonline.comosoftupdater[.]info; gogolfonline[.]com; heroestales[.]com; wantsellonline[.]com; papartybus[.]com; clveeragent[.]com; congiagent[.]com; s
domainweaveridge7.com]com; trekmesh15[.]com macOS loader-delivery domains Domain weaveridge7[.]com; ember-bridge[.]com; rudder-moss[.]com; wuess[.]com Septe
domainwuess.comn weaveridge7[.]com; ember-bridge[.]com; rudder-moss[.]com; wuess[.]com September macOS telemetry and delivery domains Domain hou
sha25606a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1bcb92 SIC MP3/HTA payload and Talos clipper artifact SHA-256 06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b; d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975
sha256131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4b7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e; 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4; ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c287
sha25618c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a75053c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540; 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505; 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd
sha256249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd2819389ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505; 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938; 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e8
sha256279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb922365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7; 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 SIC MP3/HTA payload and Talos clipper artifact SHA-256 06a3
sha2563276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5; 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24 InstallFix MP3/HTA, InstallFix /cl and recovered InstallFix
sha256480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f583129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad; 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5; 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92
sha2565e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8adake Ledger, Trezor and Exodus application artifacts SHA-256 5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad; 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c89179
sha2566759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7c218e1aba3fcb Recovered x86 artifact and Amatera PE SHA-256 6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7; 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739
sha25693d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae41ef5d316a1ae8631329349287e6a411 Metadata artifacts SHA-256 93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae; e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494
sha2569eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938; 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96 Houston, Pressureulcerlawyer, Lalandscapelighting, Aidevmas
sha256a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7; a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411 Metadata artifacts SHA-256 93d986f39599df747e4f65484a41d5e5
sha256d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29cbdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b; d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c; ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0
sha256d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2949cfc514f145262136898b009 September macOS artifact SHA-256 d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2 AccountsHelper artifact SHA-256 f71d72711fe132f00d1a10d6f8c
sha256d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcbb13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331; d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb Recovered x86 artifact and Amatera PE SHA-256 6759c72365d0c
sha256d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7; d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540; 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e5
sha256e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6cf39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae; e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c Arkypc loader and helper SHA-256 f8d09bb7ef38015342fb8ae11c
sha256ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331, InstallFix /cl and recovered InstallFix artifacts SHA-256 ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331; d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1a
sha256ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb1301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4; ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb Fake Ledger, Trezor and Exodus application artifacts SHA-25
sha256ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7ec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c; ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7; d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b
sha256eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009Selectors for getData() , balanceOf() and setData() SHA-256 eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009 September macOS artifact SHA-256 d4150c1c97f047c6edb14767bf
sha256f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f763b124f38f27da4ef52d570aac2 AccountsHelper artifact SHA-256 f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7; a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287
sha256f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75eb41998c43341fcf3a494573d6c Arkypc loader and helper SHA-256 f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e; 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f1
Full article1,259 words · extracted from cybersecuritynews.com · click to collapse

Hackers have used a trusted Reddit identity to turn advertisements into a malware delivery channel. A compromised, verified HBO Max account, u/hbomax, published 108 malicious ClickFix ads over 48 hours, sending people toward fake software pages.

The campaign did not rely on a software vulnerability. It relied on persuasion: a polished page claimed to offer a native HBO Max app for macOS, then told visitors to copy a command into Terminal. That handed the final execution step to the victim.

HudsonRock researchers, working with independent researcher Kirk from ADAMnetworks, identified the activity as part of a wider cross-platform operation they call PasteSwitch.

The operation linked fake streaming ads with lures for AI tools, developer utilities and disk-cleaning software. The potential impact goes well beyond an unwanted ad.

HudsonRock said in a report shared with Cyber Security News (CSN) that PasteSwitch can deliver credential stealers, Windows loaders and cryptocurrency-address clippers, risking browser data, saved passwords and digital assets.

The initial report (Source - Hudson Rock)
The initial report (Source – Hudson Rock)

It also gives attackers a reusable framework that can swap brands, lures and payloads while retaining the same underlying core delivery methods. Reddit paused the ads and began an investigation, but a verified account is not proof that a download is safe.

Hackers Hijack HBO Max Reddit Account

The suspicious advertising was first reported after a Reddit user encountered an official-looking ad from u/hbomax.

It promoted a standalone macOS application that does not exist. The linked page copied HBO Max branding before presenting its trap.

ClickFix works by replacing a normal install with a manual action. After a visitor pressed Download, the page displayed an overlay that asked them to copy and paste a command. As recent ClickFix malware attacks demonstrate, this approach makes users run attacker code.

The fraudulent landing page hosted at hbomaxx[.]us (Source - HudsonRock)
The fraudulent landing page hosted at hbomaxx[.]us (Source – HudsonRock)

The operators moved quickly as domains were detected or blocked. Ads included 40 streaming-themed placements using hbomaxx[.]app, 36 developer-focused ads linked to codex-craft[.]com, 15 tied to apple.clean-disk-guide[.]com, 11 for code-desktop[.]com and six for hbomax-macos[.]com.

The compromised account gave the actors a trusted advertising identity for two days. Convincing branding can lower caution around ads.

PasteSwitch Expands Across Platforms

The researchers found a delivery system that changes its path depending on the visitor and campaign. On macOS, the pasted command can use curl and zsh to fetch MacSync, AMOS-related helpers or fake wallet apps.

They can collect credentials, Telegram data, Apple Notes and macOS passwords; fake wallets seek recovery phrases. Windows visitors can receive a separate InstallFix route that uses mshta and PowerShell.

A disguised MP3/HTA file can create a scheduled task, launch 32-bit PowerShell and disable the Antimalware Scan Interface before subsequent code runs.

Amatera can then load into memory, evading conventional file-based checks. The report also described deceptive TLS traffic that connected to an attacker-controlled IP while presenting facebook.com as its visible server name, potentially misleading simple network logs.

The operation’s clipper branch adds another risk. AnimateClipper and ZigClipper watch the clipboard and replace copied cryptocurrency addresses with an attacker’s address.

The archived account activity using PullPush (Source - HudsonRock)
The archived account activity using PullPush (Source – HudsonRock)

Their controllers can retrieve a current command-and-control domain from Binance Smart Chain contracts, letting actors rotate infrastructure.

Defenders should block the listed infrastructure, inspect alerts involving copied commands and investigate unexpected Terminal, Run-dialog, mshta or PowerShell activity.

Never paste commands from ads, pop-ups or web pages. Mac-focused ClickFix delivery chains show why verification and installer commands deserve caution.

Organizations should also review whether staff saw the ads or visited the associated sites, reset exposed credentials if exposure is suspected and monitor for unusual browser-data collection.

Network teams can correlate direct IP connections with unusual SNI, DNS and certificate behavior. Earlier reporting on blockchain C2 malware campaigns also illustrates why blockchain-based control channels need attention during an investigation.

The HBO Max incident is a reminder that malvertising can borrow the reputation of a legitimate account, then turn a routine click into an infection. Treat copy-and-paste install prompts as warnings and validate software through official channels.

Indicators of Compromise (IoCs):-

TypeIndicatorDescription
IP address45.94.47[.]204:80AMOS helper enrollment, task polling and acknowledgement server
IP address77.91.65[.]13:443Amatera direct-to-IP TLS command-and-control server using facebook[.]com SNI
IP address165.22.199[.]85September macOS telemetry and /contact data exfiltration
IP address164.90.161[.]147:80September macOS post-execution HTTP contact
IP address92.246.136[.]14AMOS helper fallback /contact exfiltration
IP address62.60.226[.]69Shared Nova and macOS-tool cluster provisioning infrastructure
IP address176.53.159[.]66Shared delivery infrastructure associated with TLS and Windows executable activity
IP address172.236.51[.]169Origin observed for storageprofiler[.]com gated lure
IP address138.124.93[.]32AMOS helper /contact exfiltration
IP address168.100.9[.]122AMOS helper /contact exfiltration
IP address199.217.98[.]33AMOS helper /contact exfiltration
IP address38.244.158[.]103AMOS helper /contact exfiltration
IP address38.244.158[.]56AMOS helper /contact exfiltration
Domainfilequanticore[.]com; filesiriuscore[.]com; alfredaps[.]com; hbomaxx[.]us; hbomax-macos[.]com; bright-links[.]com; codex-notes[.]com; storageprofiler[.]com; cladesktop[.]gitlab[.]io; cli-desktop[.]com; cli-stack[.]com; homebrwmac-hub[.]com; clean-disk-guide[.]comCopied-command lure domains
Domainflutelikelurkerunsinewy[.]com; camaligsalvatrefoils[.]comClick-tracking domains
Domainpress29[.]com; leaf68[.]com; basequill9[.]com; perchframe15[.]com; canvas-35[.]com; pine63[.]com; trekmesh15[.]commacOS loader-delivery domains
Domainweaveridge7[.]com; ember-bridge[.]com; rudder-moss[.]com; wuess[.]comSeptember macOS telemetry and delivery domains
Domainhoustongaragedoorinstallers[.]com; pressureulcerlawyer[.]com; lalandscapelighting[.]com; aidevmaster[.]com; pinescope11[.]com; dogtrainersgeorgia[.]com; denverplumbingandwaterheater[.]com; restoremental[.]com; glowmedaesthetics[.]com; marbellaresales[.]com; gatemaden[.]space; beaocnagent[.]com; hbubagent[.]comMacSync delivery and control domains
Domainarkypc[.]com; harbor-29[.]com; fern-plume[.]com; node-slate[.]com; grove-12[.]com; verse-18[.]com; lakhov[.]com; mpasvw[.]com; ouilov[.]com; aforvm[.]comAMOS helper and tasking domains
Domainloop-lumen[.]com; umapla[.]com; glrack[.]comFake wallet delivery domains
Domaindesktop-version[.]com; oakenfjrod[.]ruWindows staging domains
Domainsic180[.]com; habar55[.]namebright[.]bikeSIC Windows-route domains
Domaincrisp-paths[.]com; cli-guides[.]com; macdeveloperhub[.]com; macfixguide[.]com; claud-tips[.]com; codex-paths[.]com; cmux-lab[.]com; rectangleap[.]com; muse-code-ide[.]com; hbomaxx[.]app; codex-craft[.]com; code-desktop[.]com; claude-tools[.]com; clean-disk-tools[.]com; opendisplay[.]usProvisioning-linked lure domains
Domainapplediag[.]com; getnova[.]top; nova-desk[.]top; nova-fix[.]top; nova-hub[.]top; nova-labs[.]top; nova-tools[.]top; novastacktips[.]com; remotion-skills[.]com; macstoragetips[.]comProvisioning-neighborhood domains
Domainchatgpt-safepage[.]com; thepullmanfolkestone[.]com; gigappyworld[.]com; microsoftupdater[.]info; gogolfonline[.]com; heroestales[.]com; wantsellonline[.]com; papartybus[.]com; clveeragent[.]com; congiagent[.]com; sgaaagent[.]com; sprieagent[.]com; cosimcagent[.]com; cehamilton[.]com; broadwalkindia[.]com; cim-kolea[.]com; hindustanagency[.]comTeardown and delivery-neighborhood domains
Domaineuquiz[.]spaceAddress-reuse domain
Domainlb[.]propertyfind[.]ccSmart-contract-resolved command-and-control domain
Domainbr[.]hugo-lapp[.]co; carlessclapped[.]com; cf[.]hugo-mapp[.]co; cw[.]hugo-lapp[.]lat; dau[.]hugo-mapp[.]co; dmt[.]unguidedfreewill[.]co; doh[.]hugo-mapp[.]co; ed[.]hugo-lapp[.]lat; en[.]hugo-mapp[.]co; esp[.]hugo-mapp[.]co; fcp[.]unguidedfreewill[.]co; fd-api-irc[.]velqo7[.]co; fd-api-irf[.]velqo7[.]coC2 history decoded from AnimateClipper and ZigClipper smart-contract transactions
URL path / artifact/dynamic?txd=; /tmp/osalogging.zip; .com.apple.accountsd; /api/join/; /api/tasks/<bot-id>MacSync and AMOS helper staging, persistence, enrollment and tasking indicators
Smart contract0x6936edc505501EBB2F202C985a021a06f1c10C9EAnimateClipper Binance Smart Chain contract
Smart contract0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468ZigClipper Binance Smart Chain contract
Cryptocurrency wallet0x3a35b409af86e79e8945d6a7ffb1dc59b8dbdf46Attacker controller address associated with contract updates
Smart-contract method0x3bc5de30; 0x70a08231; 0x47064d6aSelectors for getData(), balanceOf() and setData()
SHA-256eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009September macOS artifact
SHA-256d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2AccountsHelper artifact
SHA-256f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7; a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411Metadata artifacts
SHA-25693d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae; e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6cArkypc loader and helper
SHA-256f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e; 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4; ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfbFake Ledger, Trezor and Exodus application artifacts
SHA-2565e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad; 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5; 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24InstallFix MP3/HTA, InstallFix /cl and recovered InstallFix artifacts
SHA-256ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331; d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcbRecovered x86 artifact and Amatera PE
SHA-2566759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7; 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92SIC MP3/HTA payload and Talos clipper artifact
SHA-25606a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b; d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c; ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7; d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540; 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505; 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938; 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96Houston, Pressureulcerlawyer, Lalandscapelighting, Aidevmaster, Pinescope11 and Dogtrainers MacSync shell stages, plus Trekmesh15 AMOS helper shell stage
Cryptocurrency wallet0xA1E50DaF64fb2B342A64d848E396700962acC2d0; 1PbWWqgKDBDorh525uecKaGZD21FGSoCeR; 31kwGkJP9xM26cnQJLpe1CH6pjSt4DEDz2; 32Epo1K92Xzo6Hayq1Fmkj21x4fUk7JZT7; bc1qcg5sx6a6evx5ls4gj6nh8d0jtamh89n2y473dr; bc1pqn73hlel3mmnza0kfl2alwkkgkapeeknufgtysll8fs2z4umdf0qpvus9q; ltc1qk437ykzdxms9k9wh5vhd7aalsv0tfx6r39rrtv; LV9AYZKQEg891crnof7PFK6u77noVM4Y45; MG1FerSxboiwjhvU2cv4n34pXz5FpC88p4; TNf4nzc6x6fZrBMLMaZZGV1SbCjShDqbaQ; r9yMnTm4NSzvG9rrwjM2ec8xZgh1cafXH8; cosmos1k5xu6njlc90r92gdwvtfjh826jduw7ptmry0q8; UQDvDUxFShoWWbHougyHjr0tFz3E38fX8e0bnTUpya-P0mXW; DH9W9S6mSSBsGeiSstgsGdiREZupQbZf9CAnimateClipper and ZigClipper cryptocurrency address-replacement targets
Cryptocurrency walletaddr1q96640zpnccyktlmjqnzqnypwugva9g9dcuk0f5jt9mjz3xh54zest5mg6mqh9d; stake1u8t623vc96d5ddstjk46q2l59jeg38y3d0g2asqzf2n2ntqjv72k8; X-avax1h9qxee0820ezfkgeeuc02gkc0c77xrypx8z6g2; bitcoincash:qqkmn6qq7k0wpa5x7qxze5c4lkcsjkrsvsy2ecll6y; bnb1jvds8pg6zkxd2s7dl8klr0dye5avlfv8mm25jm; bc1qkg288agwvjs9cnmhz2q2f4p0x6nttwwngue7v0; 1EZk7eLw52dErMygLvfKQJJ6KVWk8gPgvE; 3K4JfWQv1ye2DAmgfcnMUBJSLnux7Lpf2X; bc1p6nwq0zs0dhcf5zgsfhjrr93enggkzmvqpwxld85egv7zamrcktqsdxmjvt; cosmos13ppe5rlcmlsgp4mlzxuma4nypcgh22upkjgf0k; DNZCS9qtuibaMtgVTf9Ttr7SuXaXRCMsDN; 13ky7J5igHNFeYogpkPh88CzwFNNh46DseTT64uqqvumgeJyWuess clipper cryptocurrency address-replacement targets

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

Tushar Subhra Dutta

Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.

Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/hackers-hijack-hbo-max/