Hackers hijacked HBO Max’s official Reddit account to run malicious ads that led users to ClickFix pages and infected Windows and macOS devices with information-stealing malware. The campaign, linked by researchers to PasteSwitch, also pushed fake AI tools, developer software, and cryptocurrency wallet apps to steal credentials and wallet recovery phrases. #HBOMax #PasteSwitch #MacSync #AMOS #AmateraStealer #AnimateClipper #ZigClipper
Keypoints
- The verified u/hbomax Reddit account was hijacked and used to post 108 malicious ads in about 48 hours.
- The ads relied on ClickFix to trick victims into running attacker commands in Windows or macOS tools.
- The campaign redirected users to fake HBO Max and other deceptive sites offering apps and utilities.
- Researchers linked the activity to PasteSwitch, which delivers stealers, loaders, and crypto theft malware.
- Payloads included MacSync, AMOS helper, Amatera Stealer, and fake Ledger, Trezor Suite, and Exodus apps.