Attackers hijacked the verified HBO Max Reddit account to push 108 malicious ads over 48 hours, leading users to a ClickFix landing page mimicking HBO Max. The page tricked macOS users into running curl | zsh commands and Windows users into executing MSHTA and PowerShell scripts, delivering malware such as MacSync, AMOS Helper, Amatera Stealer, and clipboard hijackers AnimateClipper and ZigClipper. The malware stole sensitive information including credentials and cryptocurrency wallet data, and maintained persistence. The malware communicated with command-and-control servers, some hosted on blockchain infrastructure. The campaign, tracked as PasteSwitch, was active since early 2026 and used advanced evasion techniques. Reddit removed the malicious ads promptly after being alerted.

The campaign enabled attackers to steal sensitive user information including credentials, messages, browser data, and cryptocurrency wallet details from both macOS and Windows users. It also allowed persistent access to infected machines and hijacked cryptocurrency transactions by replacing wallet addresses. The use of trusted system utilities for execution and blockchain-hosted command-and-control infrastructure increased the stealth and resilience of the malware. The compromise of a verified Reddit account lent credibility to the malicious ads, increasing the risk of user compromise.

Reddit has suspended the malicious advertisements associated with the compromised HBO Max account. Users should avoid executing commands from untrusted sources, especially those prompting terminal or PowerShell commands. Since this attack relies on social engineering via a compromised account, monitoring for suspicious ads and verifying official sources is critical. No official patch or fix applies as this is a social engineering and malware delivery campaign. Users should ensure endpoint security solutions are updated to detect related malware families. Warner Bros. and Reddit should investigate and secure the compromised account to prevent recurrence.