The verified Reddit account for HBO Max was hijacked by threat actors who utilized the platform to run 108 malicious advertisements over a 48-hour period. Researchers at Hudson Rock and ADAMnetworks identified the campaign, tracked as PasteSwitch, which leveraged the trusted status of the corporate account to distribute fake software tools and utilities to unsuspecting users.
The advertisements directed victims to lookalike websites that mimicked the official HBO Max portal. These sites prompted visitors to download a non-existent native macOS application for the service. Instead of a standard installer, the pages employed a social engineering technique known as ClickFix, which instructs users to copy a specific command and execute it within their system's Terminal or PowerShell interface.
By guiding users to manually run these commands, the attackers successfully transferred execution from the browser to trusted system utilities. On macOS, the payloads included infostealers such as MacSync and AMOS, designed to harvest browser credentials, Apple Notes, and cryptocurrency wallet recovery phrases. Windows users were targeted with the Amatera infostealer, which operates directly in system memory to bypass traditional detection methods.
The PasteSwitch infrastructure is capable of tailoring its delivery based on the visitor's device and the specific lure being presented. Beyond credential theft, the campaign has been linked to clipboard hijackers that monitor for copied cryptocurrency wallet addresses and replace them with attacker-controlled destinations. Security researchers noted that the underlying infrastructure for this operation appears to have been established as early as 2025.
Reddit administrators suspended the malicious advertisements and initiated a security investigation following reports of the activity. While the platform has taken action, security experts emphasize that verified account status does not guarantee the safety of advertisements. Users are advised to avoid running commands copied from web sources and to verify software downloads through official company websites rather than promotional links.