108 Malicious Ads: Hackers Hijack HBO Max Reddit for ClickFix

For threat hunters and SOC analysts, the HBO Max Reddit hijack is less a brand-safety story than a live demonstration of ClickFix's detection gap. The campaign's move from browser to native shell via curl | zsh and MSHTA/PowerShell means classic file-reputation controls will not catch the compromise. Tracking the PasteSwitch operation requires command-line telemetry, unusual ad-platform account behavior, and visibility into blockchain-backed C2.

The compromise of HBO Max's verified u/hbomax Reddit account and its use to push 108 malicious advertisements over roughly 48 hours represents a new escalation in malvertising and social-engineering tradecraft. Security researchers from Hudson Rock and ADAMnetworks tied the abuse to a tracked operation called PasteSwitch, which used the trusted streaming brand to drive Reddit users to a fake HBO Max site, hbomaxx[.]us. Instead of relying on a drive-by exploit or a malicious file attachment, the operation's landing page deployed ClickFix, a technique in which visitors are shown a fake error, CAPTCHA, or download prompt and instructed to copy a command from the browser and paste it into Windows Run, PowerShell, or macOS Terminal. That manual step shifts execution from the browser into a legitimate operating-system interpreter under the victim's own account, allowing attackers to sidestep browser-based blocklists, download scanning, and many endpoint controls that key on malicious file provenance.

“

Security researchers from Hudson Rock and ADAMnetworks tied the abuse to a tracked operation called PasteSwitch, which used the trusted streaming brand to drive Reddit users to a fake HBO Max site, hbomaxx[.]us.

ClickFix is not new, but its rise reflects how effectively attackers have adapted to improved browser defenses and user training. The ADAMnetworks description of the download button is instructive: clicking it opened a ClickFix prompt that told the visitor to copy a command, open Terminal, paste it, and run it. This action transferred execution from the browser to a trusted system utility that the victim controlled. In the PasteSwitch instance, macOS victims were fed a curl | zsh pipeline, a command pattern that fetches a remote script and executes it locally. The resulting payloads included MacSync, AMOS Helper, fake cryptocurrency wallet applications, and additional information-stealing code. The researchers reported that the malware sought credentials, messages, browser data, and cryptocurrency wallet information, and attempted to establish persistence on the infected machines. Because the download appears to be a native HBO Max macOS application—an application that does not exist—the bait targeted users who might reasonably trust a verified brand account and expect such an app.

Windows victims were handled with a different but equally familiar execution chain. The campaign used MSHTA and PowerShell to deliver Amatera Stealer, a credential and information stealer configured for manual credential validation. The malware attempted to evade network telemetry by spoofing Facebook connections to obscure its command-and-control communications. This dual-channel approach—native macOS scripting on one side and Microsoft-signed script hosts on the other—lets PasteSwitch target almost any consumer or employee who can be convinced to paste a command. It also complicates detection because legitimate administrative workflows can involve the same system utilities.

The larger PasteSwitch operation goes beyond initial access. Hudson Rock and ADAMnetworks found the attackers deployed AnimateClipper and ZigClipper as persistent clipboard replacement tools, swapping cryptocurrency destination addresses at the moment a victim attempts a transaction. The attackers hosted C&C infrastructure on a blockchain, making takedown and sinkholing considerably harder than a conventional domain or IP. The researchers assessed that the infrastructure was likely established more than a year ago and has been used in attacks since early 2026, suggesting a sustained campaign with reusable tooling rather than a one-off compromise. The 108 ads were spread across five lure groups, implying methodical A/B testing of impersonations and fake software.

For security teams, there are several implications. First, verification on Reddit or any social platform does not equal account security. A compromised corporate social account can amplify malicious content to a large, trusted audience while evading suspicion. Second, detection approaches that focus on downloaded files will miss ClickFix attacks because no malicious file crosses the browser boundary; the dangerous activity is the pasted command. Organizations should restrict execution of curl, zsh, PowerShell, and MSHTA where possible, monitor command-line telemetry for suspicious paste-and-run patterns, and train users that legitimate vendors will never ask them to paste commands to fix an error or verify a CAPTCHA. Third, brand impersonation extends beyond email to social advertising, and companies should monitor both their accounts and impersonating domains with the same urgency as phishing.