Verified HBO Max Reddit Account Used to Spread Mac and Windows Malware

A verified Reddit account linked to streaming service HBO Max was used over a two-day period to publish 108 malicious advertisements targeting macOS and Windows users. The account, `u/hbomax`, was exploited in an operation that Hudson Rock and Malwarebytes linked to a threat group dubbed “PasteSwitch.” The campaign delivered malware built to steal passwords, sensitive files, and cryptocurrency assets.

The advertisements promoted a native HBO Max desktop application for macOS, although HBO Max does not offer a standalone native macOS application. Security researcher Alex Cutts initially flagged the deployment on the `r/cybersecurity` subreddit, noting that the promotion came from an official verified account.

Users who clicked the advertisements were sent to an external landing page and told to copy a code string into a system utility. On macOS, the instructions directed them to Terminal; on Windows, they used the Run dialog and PowerShell. This social engineering method, known as “ClickFix,” presented the command as part of an application installation, system fix, or identity verification step.

Because the browser did not directly download an executable payload, the technique bypassed standard browser security controls and file reputation filters. The pasted command was instead executed by the victim’s native operating system utility, which then downloaded and installed the malware on the device.

Technical analyses found that PasteSwitch adjusted its payload according to the visitor’s operating system and the software lure shown in the advertisement. Mac systems received MacSync and Atomic macOS Stealer (AMOS), while Windows targets received information stealers alongside cryptocurrency “clippers.”

First identified by cybersecurity researchers in early 2023, AMOS is a specialized infostealer sold through Telegram channels and dark web forums under a malware-as-a-service model. It is typically offered for around $1,000 per month and searches infected Mac endpoints for browser credentials, system Keychain passwords, local files, Telegram session data, Apple Notes entries, and cryptocurrency wallet recovery seed phrases linked to Exodus, Electrum, and MetaMask.

The Windows clippers silently monitor the clipboard for strings that match cryptocurrency wallet address formats. When a user copies an address to send funds, the malware replaces it with an address controlled by the attacker. Pasting the replacement without checking every character permanently routes the transaction funds to the threat actor.

PasteSwitch also used public blockchain networks to maintain command-and-control (C2) communication and evade network blocklists. Its malware queried Binance Smart Chain (BSC) smart contracts acting as mutable “dead-drop resolvers” to retrieve the latest active C2 server IP address. The operators could change infrastructure locations through the blockchain without updating the deployed malware code, preventing traditional domain sinkholing by cybersecurity defenders.

The use of blockchain-based C2 resolution has expanded alongside ClickFix delivery. Microsoft Threat Intelligence previously documented a separate campaign that used fake CAPTCHA prompts to persuade Windows users to run malicious command lines, with the BNB Chain storing and serving executable instructions. Researchers also identified a large-scale ClickFix campaign in August that compromised nearly 2,000 WordPress websites with fake verification prompts intended to drain cryptocurrency wallets.

The brand account’s history added to the appearance of legitimacy. Warner Bros. Discovery rebranded HBO Max as “Max” in the United States in May 2023, but legacy brand handles and verified social media profiles have remained active across various third-party platforms.

After public reports, Reddit administrators paused all 108 advertisements associated with the account and opened an internal security investigation into how the credentials or session tokens for `u/hbomax` were obtained. Cybersecurity reports said the incident was limited to the compromise of the third-party Reddit advertising handle, with no evidence of a breach involving HBO Max’s core streaming infrastructure, internal corporate systems, or customer databases.

The number of users who executed the malicious commands, along with the overall financial or cryptocurrency losses from the 48-hour campaign, remains unconfirmed.