Hackers Hijack HBO Max’s Reddit Account to Push ClickFix Malware

Cybercriminals hijacked HBO Max’s verified Reddit account and used it to run 108 malicious adverts over about 48 hours, according to researchers at Hudson Rock. The adverts promoted fake AI tools, developer software and macOS utilities, using the account’s trusted status to make them appear more credible. Reddit administrators paused the adverts and opened a security investigation after receiving reports.

Some adverts led to convincing HBO-themed imitation websites offering a supposed native HBO Max app or promotional download. Rather than supplying an installer, the sites told visitors to open Terminal on macOS, or the Run dialogue or PowerShell on Windows, and paste in a command. This is the ClickFix social-engineering technique, in which malicious instructions are disguised as a routine fix, CAPTCHA or software installation step. ADAMnetworks calls the operation “PasteSwitch” and said its infrastructure appeared to tailor the next stage to the visitor’s device and lure.

Observed macOS payloads included MacSync and AMOS infostealers, which can steal browser credentials and profiles, Telegram data, Apple Notes, saved passwords and cryptocurrency wallet recovery phrases. Windows users could receive the in-memory Amatera infostealer, while the operation was also linked to cryptocurrency clipboard hijackers that replace copied wallet addresses with attacker-controlled ones.

Users should avoid running commands supplied by adverts or untrusted websites, visit official websites directly and treat verified accounts as no guarantee of safety. Some users on macOS Tahoe 26.4 or later may receive a warning when pasting into Terminal, but the article says this warning is not universal.