Hackers Hijack Verified HBO Max Reddit Account to Spread Infostealer Malware

A verified HBO Max Reddit account was compromised and used to run 108 malicious ads over 48 hours, quietly infecting Windows and macOS devices with credential-stealing malware through a sophisticated social engineering technique.

The attack — uncovered not by automated threat detection but by an observant Reddit user — exposes a troubling reality in modern cybersecurity: brand trust itself has become an exploitable attack surface. When verified accounts carry the visual weight of legitimacy, a single compromise can fuel a malvertising operation at scale before any organisation even knows something is wrong.

Understanding the mechanics of this attack matters beyond the headline. The techniques used here — account takeover, ClickFix payload delivery, and multi-platform infostealer deployment — represent an accelerating convergence of threats that security teams need to recognise and prepare for, not treat as isolated incidents.

---

How a Reddit User Cracked the Case Open

The campaign came to light on September 17, 2026, when Reddit user u/Unhappy-Capital-1464 posted to r/cybersecurity after spotting something unusual. An ad authored by u/hbomax — a verified account with a history of posts in official HBO Max subreddits — was promoting a macOS HBO Max app they had never heard of.

Before sounding the alarm, the user did their homework. They checked for the most common explanation: a lookalike account using character substitution in the username.

"I did consider some sort of character substitution in the username but clicking it took me to the profile," they wrote — ruling out a spoofed handle and confirming instead a genuine account takeover.

The ad redirected to hbomaxx[.]us, a landing page styled to closely mimic HBO Max's real branding, pricing tiers, and legal disclaimers. Clicking through triggered what the poster immediately recognised as a ClickFix attack. Rather than execute the payload on a live system, they sandboxed it and reported the account directly to both Reddit and HBO.

Security researchers at Hudson Rock and ADAMnetworks later tied the campaign to a broader operation they call PasteSwitch — named for its use of attacker-supplied commands that victims paste into their own systems, paired with a backend that switches between campaigns, platforms, and payloads depending on who clicks.

Why This Discovery Method Should Concern Every Security Team

The fact that a single community member identified this campaign before any automated system flagged it is not a feel-good story — it is a warning. Organisations investing heavily in endpoint detection and response tooling need to ask a harder question: are verified social media accounts even within scope of your threat monitoring programme?

Proactive social media threat monitoring and detection has historically been treated as a reputation management concern rather than a security function. This incident reframes that assumption entirely. If the u/hbomax account had been included in a continuous monitoring workflow, the 108 ads and 48-hour window of exposure could have been dramatically reduced.

---

Inside the ClickFix Delivery Chain

ClickFix is a social engineering method that disguises a malicious command as something routine — a CAPTCHA verification, an app install prompt, or an error resolution step — and instructs the victim to copy and paste it into Terminal, PowerShell, or the Windows Run dialog themselves.

Because the victim executes the payload manually using legitimate system tools, ClickFix routinely bypasses browser and endpoint protections built to catch file-based malware downloads. The con is elegant in its simplicity: hand someone a convincing enough reason to act, and they become the final stage of the delivery mechanism themselves.

The macOS Attack Path

On macOS, one observed command was Base64-encoded to obscure its function. Once decoded, it pulled a payload from ember-bridge[.]com — infrastructure Hudson Rock linked to PasteSwitch activity throughout September. The resulting malware included:

• MacSync — harvests browser credentials, Firefox profiles, Telegram data, Apple Notes, and macOS keychain passwords
• AMOS helper — a persistence tool referencing the well-known Atomic macOS Stealer that can enroll infected machines with attacker-controlled infrastructure for further tasking

The Windows Attack Path

On Windows, one attack chain used an MP3/HTA polyglot file to create a scheduled task, launch 32-bit PowerShell, disable the Antimalware Scan Interface, and generate victim-specific infrastructure keyed to the computer name and username. Later stages loaded Amatera Stealer directly into memory — skipping the disk entirely to evade detection.

Memory-only payload execution is a deliberate evasion technique. By never writing to disk, the malware sidesteps signature-based antivirus scanning and forensic recovery after the fact, making post-incident analysis significantly more difficult for defenders.

Cryptocurrency Theft as a Secondary Objective

The campaign also pushed clipboard-hijacking crypto malware — AnimateClipper and ZigClipper — alongside fake Ledger, Trezor Suite, and Exodus wallet apps designed to steal cryptocurrency recovery phrases.

Clipboard hijacking is particularly insidious for crypto users because it operates silently after infection: a copied wallet address is replaced mid-paste with one controlled by the attacker, redirecting transactions without any visible sign of interference. To understand the full taxonomy of threats like these, it helps to review the different types of malware and how they work — the range of techniques deployed in this single campaign alone spans several distinct malware categories.

---

A Campaign Far Broader Than One Streaming Brand

HBO Max was not the operation's only lure. Researchers identified a network of malicious domains extending the campaign's reach well beyond streaming subscribers:

• hbomaxx[.]app — 40 ads
• codex-craft[.]com (fake AI/developer tool) — 36 ads
• apple.clean-disk-guide[.]com — 15 ads
• code-desktop[.]com — 11 ads
• hbomax-macos[.]com — 6 ads

The diversification of targets — from streaming users to developers to anyone searching for AI utilities — reflects PasteSwitch's adaptive design. Its backend infrastructure is built to pivot quickly between platforms and personas, making it a persistent and scalable threat rather than a one-off campaign.

How PasteSwitch Scales Its Operation

PasteSwitch is not a static campaign — it is a modular attack framework. Its name captures two core capabilities: the use of paste-based payload delivery to bypass technical controls, and a dynamic switching mechanism that rotates lures, infrastructure, and malware families based on the victim's platform, behaviour, and context. This architecture allows operators to run simultaneous campaigns across multiple brand impersonations without rebuilding their tooling for each target.

This kind of adaptive, multi-vector operation is precisely what makes understanding social media account security and the risks of compromise so critical for organisations maintaining a verified presence on any platform. A compromised brand account is not just a PR problem — it is ready-made infrastructure for the next wave of the same campaign.

What Happened After the Report

After the ads were reported, a Reddit administrator paused them and escalated the incident to Reddit's Security and Safety teams. How the u/hbomax account was originally compromised remains unclear. HBO and Warner Bros. Discovery had not responded to requests for comment as of publication.

For further context on the scale of credential theft operations and the infrastructure that supports them, the FBI's Internet Crime Complaint Center (IC3) publishes annual reports documenting the financial and operational impact of malware campaigns of this type.

---

How to Act on This Information

The incident is a sharp reminder that organisations maintaining verified social media presences should treat those accounts with the same access controls, monitoring, and incident-response readiness as any other privileged credential. A verified badge communicates trust to users — which means a compromised verified account communicates that same trust, weaponised.

1. For security teams and IT professionals — audit all verified brand accounts across social platforms immediately and enforce multi-factor authentication and access logging as baseline controls, not optional measures.
2. For everyday users — treat any prompt asking you to paste a command into Terminal or PowerShell as an immediate red flag, regardless of how legitimate the surrounding branding appears.
3. For organisations — establish a clear internal process for receiving and acting on user-submitted threat reports, because in this case a vigilant community member detected the attack before the targeted brand did.