Threat Intelligence HBO Max Reddit account compromised, used in ‘PasteSwitch’ ClickFix attacks September 16, 2026 Share By Laura French (Credit: Ralf – stock.adobe.com) The official HBO Max Reddit account was reportedly compromised and used in a malvertising campaign spreading infostealers and cryptocurrency clippers as part of a larger operation dubbed “PasteSwitch,” HudsonRock and ADAMnetworks reported this week. The campaign was first discovered and reported by a user named Alex Cutts on the r/cybersecurity subreddit, who noticed Reddit advertisements for a non-existent HBO Max macOS application being pushed by the official, verified HBO Max Reddit account. A joint investigation by HudsonRock and ADAMnetworks revealed the compromised account published 108 advertisements in a 48-hour period, promoting fake downloads for HBO Max on macOS, free Codex usage and macOS disk-cleaning software. “A malicious advertisement coming from a random account immediately raises suspicion, but an advertisement associated with a verified HBO Max account carries an implicit level of legitimacy. Once attackers compromise a trusted brand identity, they effectively inherit that trust and can use it as part of the social-engineering attack chain,” Ensar Seker, CISO at SOCRadar, said in comments to SC Media. Users who clicked on these advertisements would be met with brand-spoofing websites displaying ClickFix-style download instructions. The researchers traced the infrastructure from this attack to the broader PasteSwitch operation, which has been active since at least July 2025. Payloads recovered from PasteSwitch infrastructure were found to be tailored to the user’s detected operating system, targeting both macOS and Windows. On macOS, the commands copied and pasted to Terminal installed the MacSync infostealer, which steals the macOS password, system information, browser credentials and cookies, Gecko profiles, cryptocurrency wallet information, Telegram data, Apple Notes, Keychain contents, cloud credentials and shell history. The stolen data is staged at /tmp/osalogging.zip and exfiltrated to the attacker in HTTP PUT chunks of about 10 MB. PasteSwitch also delivered an AMOS helper that collected the macOS password, credentials and application data and installed persistence components disguised as Apple services. The persistent implant enrolled in a continuous tasking service, regularly copying Keychain and browser cookie data and uploading it to the attacker. Additionally, three fake cryptocurrency wallet applications impersonating Ledger, Trezor Suite and Exodus were installed for the purpose of stealing 12- and 24-word BIP39 recovery phrases. The researchers noted connections between the recent campaign and previously documented attacks, such as the “ClaudeFix” attack reported by Zscaler in July that followed the same MacSync attack pattern with Claude installation lures and a Codex-themed ClickFix campaign reported by Cato Networks last month, which showed the same AMOS execution pattern. On Windows machines, the PasteSwitch ClickFix commands used mshta to download an MP3/HTA polyglot file that created a scheduled task, launched 32-bit PowerShell, disabled the Antimalware Scan Interface (AMSI) and generated a new C2 subdomain based on the victim’s computer name and username, the researchers described. A subsequent PowerShell chain, obfuscated using arithmetic fog, dead loops, opaque predicates, base64, repeating-key XOR, rolling decoding and in-memory PE loading, culminated in the delivery of Amatera Stealer. The stealer used TLS SNI spoofing to disguise its C2 communications as connections to the Facebook website to evade SNI-based filtering. PasteSwitch has also been observed to use cryptocurrency clippers that replace crypto wallet addresses stored in the clipboard with attacker-controlled addresses. Two of these clippers, AnimateClipper and ZigClipper, used the same 21-address configuration and utilized BNB Smart Chain contracts to store rotating C2 domains. One of the endpoints used in the September attack was found to store a separate crypto clipper configuration containing 21 different wallet addresses. After the malicious Reddit advertisements were reported, Reddit paused the advertisements and launched an investigation. SC Media reached out to an HBO representative for comment and did not receive a response. “The larger security lesson is that organizations must treat corporate social-media and advertising accounts as privileged infrastructure. These accounts should have phishing-resistant MFA, tightly controlled administrator access, continuous monitoring, and rapid credential and session revocation capabilities,” said Seker. Laura French Laura French has been a staff reporter for SC Media since 2023. Laura writes daily news stories, contributes to feature stories, covers industry events and edits briefs for the SC Media website. A New Jersey native, Laura graduated from Ramapo College in 2016 and has previously written for Labcompare, FireRescue1, EMS1 and Forensic Magazine. Related Threat Intelligence 5 alleged Black Axe leaders extradited to U.S. to face fraud charges SC Staff September 15, 2026 The individuals, originally from Nigeria, are accused of operating romance and advance fee scams from at least 2011 until their arrests in South Africa in 2021. Threat Intelligence China-linked group exploits Tencent Sogou Input Method for backdoor deployment SC Staff September 14, 2026 Researchers at Gen Digital identified the vulnerability, tracked as CVE-2026-51990, as a one-click remote code execution flaw. Threat Intelligence Chinese state-linked hackers exploit Chrome vulnerability SC Staff September 9, 2026 The BlueMoon exploit kit targeted U.S. defense contractors, NGOs, and Southeast Asian government agencies. Related Events Cybercast Better Threat Intelligence Between Public and Private Sectors On-Demand Event Virtual Conference Nationwide Cybersecurity Summit 2025: Safeguarding America’s Digital Future On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Botnet DNS Spoofing Deauthentication Attack Deepfake Denial of Service Dictionary Attack Distributed Scans Fault Line Attacks Hybrid Attack Password Cracking You can skip this ad in 5 seconds