HBO Max Reddit account compromised, used in ‘PasteSwitch’ ClickFix attacks

The official HBO Max Reddit account was reportedly compromised and used in a malvertising campaign spreading infostealers and cryptocurrency clippers as part of a larger operation dubbed “PasteSwitch,” HudsonRock and ADAMnetworks reported this week.

The campaign was first discovered and reported by a user named Alex Cutts on the r/cybersecurity subreddit, who noticed Reddit advertisements for a non-existent HBO Max macOS application being pushed by the official, verified HBO Max Reddit account.

A joint investigation by HudsonRock and ADAMnetworks revealed the compromised account published 108 advertisements in a 48-hour period, promoting fake downloads for HBO Max on macOS, free Codex usage and macOS disk-cleaning software.

“A malicious advertisement coming from a random account immediately raises suspicion, but an advertisement associated with a verified HBO Max account carries an implicit level of legitimacy. Once attackers compromise a trusted brand identity, they effectively inherit that trust and can use it as part of the social-engineering attack chain,” Ensar Seker, CISO at SOCRadar, said in comments to SC Media.

Users who clicked on these advertisements would be met with brand-spoofing websites displaying ClickFix-style download instructions. The researchers traced the infrastructure from this attack to the broader PasteSwitch operation, which has been active since at least July 2025. Payloads recovered from PasteSwitch infrastructure were found to be tailored to the user’s detected operating system, targeting both macOS and Windows.

On macOS, the commands copied and pasted to Terminal installed the MacSync infostealer, which steals the macOS password, system information, browser credentials and cookies, Gecko profiles, cryptocurrency wallet information, Telegram data, Apple Notes, Keychain contents, cloud credentials and shell history. The stolen data is staged at /tmp/osalogging.zip and exfiltrated to the attacker in HTTP PUT chunks of about 10 MB.

PasteSwitch also delivered an AMOS helper that collected the macOS password, credentials and application data and installed persistence components disguised as Apple services. The persistent implant enrolled in a continuous tasking service, regularly copying Keychain and browser cookie data and uploading it to the attacker.

Additionally, three fake cryptocurrency wallet applications impersonating Ledger, Trezor Suite and Exodus were installed for the purpose of stealing 12- and 24-word BIP39 recovery phrases.

The researchers noted connections between the recent campaign and previously documented attacks, such as the “ClaudeFix” attack reported by Zscaler in July that followed the same MacSync attack pattern with Claude installation lures and a Codex-themed ClickFix campaign reported by Cato Networks last month, which showed the same AMOS execution pattern.

On Windows machines, the PasteSwitch ClickFix commands used mshta to download an MP3/HTA polyglot file that created a scheduled task, launched 32-bit PowerShell, disabled the Antimalware Scan Interface (AMSI) and generated a new C2 subdomain based on the victim’s computer name and username, the researchers described.

A subsequent PowerShell chain, obfuscated using arithmetic fog, dead loops, opaque predicates, base64, repeating-key XOR, rolling decoding and in-memory PE loading, culminated in the delivery of Amatera Stealer. The stealer used TLS SNI spoofing to disguise its C2 communications as connections to the Facebook website to evade SNI-based filtering.

PasteSwitch has also been observed to use cryptocurrency clippers that replace crypto wallet addresses stored in the clipboard with attacker-controlled addresses. Two of these clippers, AnimateClipper and ZigClipper, used the same 21-address configuration and utilized BNB Smart Chain contracts to store rotating C2 domains. One of the endpoints used in the September attack was found to store a separate crypto clipper configuration containing 21 different wallet addresses.

After the malicious Reddit advertisements were reported, Reddit paused the advertisements and launched an investigation. SC Media reached out to an HBO representative for comment and did not receive a response.  

“The larger security lesson is that organizations must treat corporate social-media and advertising accounts as privileged infrastructure. These accounts should have phishing-resistant MFA, tightly controlled administrator access, continuous monitoring, and rapid credential and session revocation capabilities,” said Seker.