HBO Max's verified Reddit account hijacked to run 108 crypto-theft ads

What happened

Attackers took control of u/hbomax, the verified Reddit account operated by the HBO Max streaming brand, and used its advertising privileges to push 108 distinct malicious advertisements over roughly two days. Every ad promoted an "HBO Max for macOS" application that, according to the research, does not exist. Reddit administrators suspended the affected ads and opened an internal investigation with the platform's Security and Safety teams to regain control of the account.

The technical analysis comes from Hudson Rock, conducted jointly with Kirk of ADAMnetworks, with additional participation from Whack.sh. A write-up of the findings appeared on dev.to.

A fake installer built around copy and paste

The campaign leans on a social-engineering pattern known as ClickFix. Rather than handing the victim a file, the lure page displays an installation or verification step and instructs the visitor to copy a supplied command into Terminal, PowerShell, or the Windows Run box. Because the command fetches and executes the payload from the user's own shell, the operating-system and browser prompts that normally inspect downloaded files never appear.

Hudson Rock and ADAMnetworks dubbed the operation PasteSwitch, a name that captures both halves of the mechanism: the victim pastes a command supplied by the attacker, and the delivery system then picks between platform, campaign, payload, and monetization routes after running checks that qualify the visitor.

Three delivery paths

The researchers documented separate payloads for different targets:

• macOS users received counterfeit Ledger, Trezor Suite, and Exodus applications written in Swift, built to harvest 12- and 24-word BIP39 recovery phrases.
• Windows users were routed down a separate chain built on mshta and PowerShell.
• Both platforms were also offered clipboard-hijacking malware dubbed AnimateClipper and ZigClipper, which silently replaces a copied cryptocurrency address with one controlled by the attacker.

Command and control on the blockchain

The clipboard malware resolves its command-and-control location from smart contracts on Binance Smart Chain, effectively using the public chain as a rewriteable pointer. Hudson Rock recorded 36 changes to the mainnet pointer from a single controller address between March and July 2026. Because the contract itself stays reachable and the pointer can be updated whenever the operator chooses, this channel keeps functioning through the hosting takedowns that would normally disrupt such an operation.

Defenses worth adopting

The researchers' guidance for individuals is blunt:

• Treat any page instructing you to copy a command into Terminal, PowerShell, or the Run box as hostile. Legitimate installers arrive as files from the vendor's own site or an official app store.
• Type vendor addresses manually rather than following advertisements.
• Enter a hardware-wallet recovery phrase only on the device itself. Any application asking for the 12 or 24 words is stealing them.
• Do not treat a verified badge as a safety guarantee; this account genuinely belonged to the brand while it served malicious ads.

For security teams, the researchers suggest naming the copy-paste-into-terminal pattern explicitly in awareness material, since guidance built around email attachments leaves it uncovered, and watching endpoints for shells that spawn shortly after browser activity or for processes that write to the clipboard.

Why it matters

The incident is a concrete demonstration that platform verification attests to ownership, not to safety. An attacker holding a verified brand account inherits both the audience-trust signals and the advertising tooling that come with it, effectively converting a marketing channel into a malware distribution channel. The ClickFix pattern compounds the problem because it sidesteps the download-scanning defenses most users rely on, and blockchain-hosted command and control raises the cost of any takedown attempt. For anyone running security awareness programs, this is a strong case for treating "paste this command" as an attack pattern in its own right.