HBO Max Reddit account compromised to serve ClickFix attacks
Attackers hijacked HBO Max's verified Reddit account to run 108 ClickFix malvertising ads delivering infostealers, loaders, and crypto clippers to Windows and macOS users.
Attackers compromised the verified HBO Max Reddit account (u/hbomax) to push 108 malicious ads in a 48-hour malvertising blitz named PasteSwitch, analyzed by Hudson Rock and ADAMnetworks. The ClickFix lures directed victims to fake landing pages instructing them to paste commands into Terminal, delivering OS-targeted infostealers, malware loaders, and cryptocurrency clippers. Lures included 46 HBO Max ads, 36 fake OpenAI Codex ads, 15 fake macOS disk utilities, and 11 developer-tool ads. The AnimateClipper and ZigClipper payloads use Binance Smart Chain contracts as resilient C2 fallback, with 36 mainnet changes observed between March and July 2026; Reddit paused the ads three days after discovery and is investigating.
- HBO Max's verified Reddit account pushed 108 malicious ClickFix ads within 48 hours
- PasteSwitch campaign served OS-targeted infostealers, loaders, and crypto clippers
- AnimateClipper and ZigClipper use Binance Smart Chain contracts for resilient C2 rotation
- Lures included fake OpenAI Codex and macOS disk-utility apps across 108 ads
- Reddit paused the ads three days after a user reported them on September 6
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | clean-disk-guide.com | Of the rest: 15 purported to be a macOS disk utility (apple.clean-disk-guide[.]com) and 11 used other developer tools as lures (code-desktop |
| domain | code-desktop.com | sk-guide[.]com) and 11 used other developer tools as lures (code-desktop[.]com). “The campaign proves once again why trusted distributio |
| domain | codex-craft.com | trick prospective victims via an OpenAI Codex theme (with a codex-craft[.]com) landing page. Of the rest: 15 purported to be a macOS di |
| domain | hbomax-macos.com | Max lure, directing app seekers to either hbomaxx[.]app or hbomax-macos[.]com. Another 36 tried to trick prospective victims via an Ope |
| domain | hbomaxx.app | s, 46 used an HBO Max lure, directing app seekers to either hbomaxx[.]app or hbomax-macos[.]com. Another 36 tried to trick prospect |
| domain | hbomaxx.us | n be taken to a “somewhat-legitimate” looking landing page (hbomaxx[.]us) that includes a join/download button. REG AD Clicking th |
From the original article
2 min read at theregister.comPart of a 'massive 48-hour malvertising blitz' targeting macOS and Windows machines with malware
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.