HBO Max Reddit account compromised to serve ClickFix attacks

1. Executive summary

Between roughly 6 and 9 September 2026, the verified HBO Max Reddit account (u/hbomax) was compromised and used to run more than 100 malicious ads — 108 distinct ads in total — in a 48-hour malvertising blitz that researchers at Hudson Rock and ADAMnetworks have named PasteSwitch. The ads impersonated a non-existent macOS HBO Max client and pushed ClickFix social engineering: victims were told to copy and paste a command into macOS Terminal, which delivered OS-targeted infostealers, loaders, cryptocurrency clippers (AnimateClipper or ZigClipper) and fake cryptocurrency wallet applications. The primary risk to EMEA financial services is not the HBO Max brand itself but the delivery model: a trusted, verified social-media account as the distribution channel, and a ClickFix payload path that bypasses email and web-content filtering entirely because the final step is a user-initiated shell command. No VERIFIED REFERENCE DATA was resolved for this item, so no CVSS score, severity rating or CISA KEV exploitation state is asserted in this advisory — the assessment below rests on vendor reporting relayed by The Register, which is single-sourced and should be treated as such.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

This is a third-party-brand abuse and commodity malvertising campaign. No EMEA financial entity is identified as a victim, no client ICT third-party provider is implicated, and no client incident, outage or data breach is described. Mapping DORA Art. 28 (ICT third-party risk) or NIS2 Art. 21(2)(d) (supply chain security) here would require the client to treat Reddit — or HBO Max — as a provider in its own supply chain, which the source material does not support. The item is relevant to client threat awareness and control tuning, not to a regulatory reporting or third-party-risk obligation. If a client's own corporate social-media account were hijacked in the same manner, DORA Art. 17/18/19 or NIS2 Art. 23 would be engaged at that point — but that is a hypothetical, not a fact in this item.

3. Technical analysis & attack chain

Confirmed attack chain

1. Account takeover. An unidentified party compromised the verified HBO Max Reddit account, u/hbomax. Warner Bros. Discovery did not respond to The Register's questions about who hijacked the account or how. The initial-access vector for the account takeover is unknown and unconfirmed.
2. Malicious ad delivery. The compromised account was used to publish more than 100 malicious ads (108 distinct ads per Hudson Rock/ADAMnetworks) over an approximately 48-hour window. The ads carried u/hbomax as the author, lending them the credibility of a verified brand account.
3. Lure. The HBO Max-themed ads advertised a macOS application for HBO Max. No native macOS client for the service exists, so the lure is inherently implausible to anyone who checks — but it is plausible enough to a user who does not.
4. Redirect to landing page. Clicking the ad took the victim to a "somewhat-legitimate" looking landing page at hbomaxx[.]us containing a join/download button.
5. ClickFix payload delivery. Clicking the button did not download a file. It produced on-screen instructions telling the user to copy and paste a command into Terminal on macOS — the classic ClickFix pattern, in which the user is socially engineered into executing the payload themselves.
6. Discovery and takedown. A Reddit user identified the infostealer ads on 6 September 2026, tested the chain in a sandboxed environment without executing the binary on their own machine, and concluded the Reddit account was compromised. Three days later Reddit paused the infostealer-dropping ads, and a Reddit admin stated that the platform's safety and security teams were investigating.

Campaign detail (Hudson Rock / ADAMnetworks analysis)

The two research firms analysed the ads and characterised the activity as a "massive 48-hour malvertising blitz" using multiple software lures. Payloads are selected according to the victim's operating system — macOS or Windows — and include infostealers, malware loaders, cryptocurrency clippers, and fake cryptocurrency wallet applications.

Lure distribution across the 108 ads:

Note that the HBO Max lure is associated with three separate domains across the reporting — hbomaxx[.]us (the page the Reddit sleuth landed on) and hbomaxx[.]app / hbomax-macos[.]com (per Hudson Rock/ADAMnetworks). Treat all three as campaign infrastructure.

Cryptocurrency clippers and blockchain C2

PasteSwitch delivers one of two clippers — AnimateClipper or ZigClipper — which additionally provide a blockchain-based command-and-control fallback. The clippers use Binance Smart Chain (BSC) contracts to dynamically fetch the current C2 domain, meaning the C2 address is not hard-coded in the sample and cannot be sinkholed by domain takedown alone. Hudson Rock reported observing 36 mainnet changes executed by the same attacker controller address between March and July 2026, and described the infrastructure as demonstrating "dynamic resilience, allowing the threat actors to easily rotate burned domains." This is the most operationally significant technical detail in the item: blocking a resolved C2 domain is a temporary measure, not a durable one.

Confidence caveats

• Single-sourced. All campaign naming ("PasteSwitch"), the 108-ad figure, the lure breakdown, the clipper family names and the BSC C2 mechanism come from Hudson Rock and ADAMnetworks as relayed by The Register. Adverse Trace has not independently corroborated these claims. Verify before enforcing blocks or writing detections into production.
• No attribution. No threat actor or group is named in the source material, and no MITRE ATT&CK profile is available for this activity. Any attribution is unconfirmed. Do not attach a group name to this campaign on the basis of this advisory.
• No initial-access detail. How the HBO Max Reddit account was compromised — credential phishing, session-token theft, insider, third-party social-media tooling — is not stated. The Register's own framing ("Maybe someone who didn't like the House of the Dragon season 3 finale?") is editorial, not analysis.
• No payload artefacts. No file names, hashes, command strings, persistence mechanisms, or C2 domains are given in the source. The advisory therefore cannot support host-based hunting on payload specifics.

4. Mitigation & containment

There is no vendor patch for this item — it is a social-engineering and brand-abuse campaign, not a vulnerability. Controls are therefore blocking, detection and user-behaviour focused.

P1 — within 24 hours

1. Block the six campaign domains at DNS resolvers, secure web gateway and forward proxy: hbomaxx[.]us, hbomaxx[.]app, hbomax-macos[.]com, codex-craft[.]com, apple.clean-disk-guide[.]com, code-desktop[.]com. Log the block hits — a hit is a live exposure signal, not noise.
2. Hunt macOS endpoints for ClickFix execution: process-creation events where Terminal (/System/Applications/Utilities/Terminal.app) or osascript spawns curl, wget, bash, sh or zsh with a piped or remote-fetch command line. The source does not give the exact command string, so hunt on the parent/child process pattern rather than a literal.
3. Where an endpoint has hit one of the domains above, treat it as a potential infostealer infection: isolate, collect volatile data, and rotate credentials and browser session tokens for anything used on that host. Infostealers are credential harvesters first.
4. If your organisation operates corporate social-media accounts, verify MFA is enforced with phishing-resistant factors (hardware keys or passkeys) and audit delegated/third-party access to those accounts. The campaign's core lesson is that verified brand accounts are the attack surface.

P2 — within 72 hours

5. Deploy the Sigma DNS rule in §6 to your DNS/proxy telemetry and the YARA rule to file-scanning and mail/web gateway pipelines.
6. Restrict or alert on interactive shell use by non-engineering macOS users where business process permits. ClickFix depends on the user pasting into a shell; removing routine shell access from finance, trading and back-office macOS builds breaks the chain at the last step.
7. Push a targeted user communication: no legitimate software vendor instructs users to paste commands into Terminal or PowerShell to install a consumer app. Include the specific tell here — HBO Max has no native macOS client, so any ad offering one is fraudulent.
8. Review ad-blocking and browser-hardening policy for corporate-managed endpoints. Reddit-served ads are a delivery channel that email and web-content filtering do not inspect.

P3 — within 7 days

9. Add the campaign domains to long-lived threat-intel blocklists with a review date, and re-check for additional domains as the campaign rotates infrastructure.
10. Because the clipper C2 is resolved via BSC contracts, do not rely on domain blocking as the sole control for this family. Where you have EDR coverage, prioritise behavioural detection of clipboard manipulation and outbound connections to blockchain RPC endpoints from non-approved processes.
11. Tabletop the scenario: a trusted third-party account your customers or staff follow is hijacked and used to distribute malware. Confirm who owns the takedown request, who communicates to staff, and how fast you can block a domain fleet-wide.

5. Indicators of compromise

All indicators below derive from a single reporting chain (The Register, citing Hudson Rock and ADAMnetworks). Single-sourced; verify before enforcement.

domain  hbomaxx[.]us
domain  hbomaxx[.]app
domain  hbomax-macos[.]com
domain  codex-craft[.]com
domain  apple.clean-disk-guide[.]com
domain  code-desktop[.]com
reddit-account  u/hbomax

No file hashes, IP addresses, file paths, registry keys or C2 domains are present in the source material. The clipper C2 domains are fetched dynamically from Binance Smart Chain contracts and are not published in the reporting.

Behavioural indicators

6. Detection

The source provides no file hashes, command strings or payload filenames, so detection is built on the campaign's domain artefacts and on the ClickFix behavioural pattern. Domain strings in the rules below are live, not defanged — a defanged string will not match.

rule PasteSwitch_ClickFix_Malvertising_Infra
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-15"
        reference = "https://www.theregister.com/cyber-crime/2026/09/14/hbo-max-reddit-account-compromised-to-serve-clickfix-attacks/5296408"
        description = "Detects PasteSwitch ClickFix malvertising artefacts referencing campaign landing-page and redirect domains. Single-sourced reporting (The Register citing Hudson Rock / ADAMnetworks); validate before production deployment."
        tlp = "AMBER"

    strings:
        $d1 = "hbomaxx.us" ascii wide nocase
        $d2 = "hbomaxx.app" ascii wide nocase
        $d3 = "hbomax-macos.com" ascii wide nocase
        $d4 = "codex-craft.com" ascii wide nocase
        $d5 = "apple.clean-disk-guide.com" ascii wide nocase
        $d6 = "code-desktop.com" ascii wide nocase

    condition:
        any of them
}

title: PasteSwitch ClickFix Malvertising Domain Resolution
id: 8f3c1a72-4d5e-4b90-9c21-7a6e0d4b2f18
status: experimental
description: >
    Detects DNS resolution of domains associated with the PasteSwitch ClickFix
    malvertising campaign, which abused the compromised HBO Max Reddit account
    (u/hbomax) to distribute infostealers, loaders and cryptocurrency clippers.
    Single-sourced reporting (The Register citing Hudson Rock / ADAMnetworks);
    validate before production deployment.
author: Adverse Trace
date: 2026/09/15
references:

    - https://www.theregister.com/cyber-crime/2026/09/14/hbo-max-reddit-account-compromised-to-serve-clickfix-attacks/5296408
logsource:
    category: dns_query
detection:
    selection:
        QueryName|endswith:

            - 'hbomaxx.us'
            - 'hbomaxx.app'
            - 'hbomax-macos.com'
            - 'codex-craft.com'
            - 'apple.clean-disk-guide.com'
            - 'code-desktop.com'
    condition: selection
falsepositives:

    - None expected. These are campaign-specific domains with no legitimate business use.
level: high
tags:

    - attack.initial_access
    - attack.user_execution

Deployment note: the Sigma rule targets DNS query telemetry. If your estate is macOS-heavy, mirror the same domain list into your SWG/proxy content rules, since ClickFix delivery is browser-initiated and may not traverse a Windows-centric DNS pipeline.

7. Sources

• The Register — HBO Max Reddit account compromised to serve ClickFix attacks — https://www.theregister.com/cyber-crime/2026/09/14/hbo-max-reddit-account-compromised-to-serve-clickfix-attacks/5296408 — published 2026-09-14.
• Hudson Rock — campaign analysis of the PasteSwitch malvertising blitz — referenced in the above article; no direct URL supplied in the source material.
• ADAMnetworks — campaign analysis of the PasteSwitch malvertising blitz — referenced in the above article; no direct URL supplied in the source material.
• Alon Gal (co-founder and CTO, Hudson Rock) — LinkedIn post on trusted distribution channels as infostealer delivery vectors — referenced in the above article; no direct URL supplied in the source material.

8. Adverse Trace position

Severity: not scored. No VERIFIED REFERENCE DATA was resolved for this item, so Adverse Trace is not asserting a CVSS score, a severity band or a CISA KEV exploitation state. The source material does not provide them, and we will not manufacture them. Qualitatively, this is a commodity, high-volume, low-sophistication delivery campaign with a genuinely effective social-engineering hook — ClickFix bypasses email and web-content filtering because the payload is executed by the user, and the abuse of a verified brand account removes the usual "is this source trustworthy?" check. Client impact: moderate and indirect. No EMEA financial institution is named as a victim; the exposure is to staff who browse Reddit on corporate-managed macOS and Windows endpoints, and the consequence of a successful hit is credential and session-token theft, which is a direct path to account takeover and downstream fraud. The blockchain-resolved C2 is the one element that raises this above routine malvertising, because domain blocking alone will not hold. All campaign specifics here are single-sourced (The Register, citing Hudson Rock and ADAMnetworks) and no actor attribution is available or implied. Next steps: we are monitoring for additional PasteSwitch domains, for any published payload hashes or command strings that would let us upgrade §6 from domain-based to host-based detection, and for corroboration of the BSC C2 mechanism from a second vendor. Clients who observe hits on the §5 domains should contact their Adverse Trace handler — a block hit on these domains indicates a user reached the ClickFix instruction stage, not merely an ad impression.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.