MalwarePublished 15 Sep 2026

Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack

Source SecurityWeek

Description

A threat actor compromised the official HBO Max Reddit account and used it to run a malvertising campaign that directed macOS and Windows users to a fake HBO Max site. The site prompted users to execute commands that installed malware designed to steal credentials, messages, browser data, and cryptocurrency wallet information, and maintain persistence. The campaign, active for 48 hours, used multiple malware families including MacSync, AMOS Helper, Amatera Stealer, AnimateClipper, and ZigClipper. Clipboard stealers replaced cryptocurrency addresses to divert transactions. Reddit suspended the malicious ads after notification.

Impact

The campaign enabled attackers to steal sensitive user information including credentials, messages, browser data, and cryptocurrency wallet details from both macOS and Windows users. It also allowed persistent access to infected machines and hijacked cryptocurrency transactions by replacing wallet addresses. The use of trusted system utilities for execution and blockchain-hosted command-and-control infrastructure increased the stealth and resilience of the malware. The compromise of a verified Reddit account lent credibility to the malicious ads, increasing the risk of user compromise.

Defensive guidance

Reddit has suspended the malicious advertisements associated with the compromised HBO Max account. Users should avoid executing commands from untrusted sources, especially those prompting terminal or PowerShell commands. Since this attack relies on social engineering via a compromised account, monitoring for suspicious ads and verifying official sources is critical. Users should ensure endpoint security solutions are updated to detect related malware families. Warner Bros. and Reddit should investigate and secure the compromised account to prevent recurrence.

Summary

Attackers hijacked the verified HBO Max Reddit account to push 108 malicious ads over 48 hours, leading users to a ClickFix landing page mimicking HBO Max. The page tricked macOS users into running curl | zsh commands and Windows users into executing MSHTA and PowerShell scripts, delivering malware such as MacSync, AMOS Helper, Amatera Stealer, and clipboard hijackers AnimateClipper and ZigClipper. The malware stole sensitive information including credentials and cryptocurrency wallet data, and maintained persistence. The malware communicated with command-and-control servers, some hosted on blockchain infrastructure. The campaign, tracked as PasteSwitch, was active since early 2026 and used advanced evasion techniques. Reddit removed the malicious ads promptly after being alerted.

References

securityweek.com/hacked-hbo-reddit-account-used-for-malware-delivery-via-clickfix-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Sep 2026, 09:16 UTC

References

Community reviews

Related threats