Verified HBO Max Reddit Account Weaponized for 108 Malicious Ads: The Anatomy

In September 2026, the verified Reddit account u/hbomax was compromised and used for an unprecedented malvertising campaign: 108 ads distributed over 48 hours delivering the PasteSwitch malware via the ClickFix technique. A joint investigation by Hudson Rock and Kirk of ADAMnetworks reconstructed the full attack chain, from visitor qualification to data exfiltration, revealing a cross-platform infrastructure that exploits verified corporate accounts to bypass user trust.

The Campaign: Numbers and Distribution

Researchers documented a precise, calculated distribution. The 108 ads were split across five lure domains: hbomaxx[.]app with 40 ads focused on streaming and entertainment, codex-craft[.]com with 36 ads targeting developers and AI tools, apple.clean-disk-guide[.]com with 15 ads, code-desktop[.]com with 11, and hbomax-macos[.]com with 6. This segmentation indicates target qualification at the surface level: the actor matched thematic lures to specific Reddit audience segments, maximizing click probability.

The 48-hour duration, according to the dossier, was sufficient to achieve significant visibility before the community flagged the compromise. Reddit suspended the ads and opened an internal investigation, as confirmed by Hudson Rock. The unconfirmed figure remains the actual victim count: the dossier does not specify how many users completed the infection chain.

The ClickFix Mechanism: When the Victim Executes the Payload

The technical core of the operation is the ClickFix technique, an advanced social engineering method that turns the user into the execution vector. The flow begins with a seemingly legitimate ad: the victim clicks and is directed to a page simulating a video display error or compatibility issue. The message instructs the user to copy a command to the clipboard and paste it into the macOS Terminal or Windows Run dialog.

On macOS, the command is a curl-pipe-zsh chain that downloads an obfuscated script, subsequently decrypted with AES-128-CTR. The primary payload, identified as MacSync, installs as a persistent helper under names mimicking Apple components: "AMOS Helper," "MacSync," and variants. Persistence is achieved via launchctl with scheduled jobs. The malware exfiltrates data from Safari, Chrome, Firefox, Telegram, Apple Notes, and the macOS keychain, compressing everything into a /tmp/osalogging.zip archive.

On Windows, the chain dubbed InstallFix uses mshta to execute an HTML Application that launches PowerShell. This loads Amatera Stealer in memory, an infostealer that writes no files to disk, reducing forensic footprint. Command-and-control communication goes to IP 77.91.65.13 on port 443, with a notable technical detail: the client presents facebook.com as the TLS Server Name Indication, an SNI spoofing technique designed to evade network filters that block based on domain name.

Blockchain Resilience: C2 That Evades Takedown

The most innovative element of the PasteSwitch infrastructure is the use of Binance Smart Chain smart contracts as a command-and-control system. The AnimateClipper and ZigClipper clippers do not contact traditional domains; they retrieve destination addresses directly from the blockchain, querying getData() and balanceOf() functions of contracts deployed on BSC.

The identified controller is address 0x3a35b409af86e79e8945d6a7ffb1dc59b8dbdf46. Between March and July 2026, the ZigClipper contract underwent 36 mainnet updates, allowing operators to mutate "burned" C2 addresses without modifying the distributed client code. In the September 2026 campaign, the runtime configuration included 21 replacement addresses. This architecture renders traditional takedowns ineffective: seizing a domain or blocking an IP does not break the chain, because the malware queries a distributed, immutable ledger.

"Because the C2 domain is hosted directly on the blockchain, the infrastructure demonstrates dynamic resilience, allowing the threat actors to easily rotate burned domains."

The investigation also revealed continuity with previous campaigns. Route identification strings compare the September 2026 campaign with the Cato campaign documented by Microsoft, Zscaler, RST Cloud, and Cato itself, suggesting evolution rather than the ex novo appearance of a new actor.

The Verification Problem: When the Badge Becomes a Weapon

The u/hbomax account was verified, a badge on Reddit that signals official authenticity and here functioned as a credibility force multiplier. The researchers' analysis is clear: the verification badge transforms a malicious ad into content that appears platform-endorsed, bypassing the healthy skepticism many users reserve for unknown sources.

The dossier does not specify how the account was initially compromised: session hijacking, stolen credentials, or other vectors remain undocumented hypotheses. However, the delivery mechanism requires no technical vulnerabilities in Reddit or HBO Max: the entire chain activates with the victim's voluntary consent, as they actively copy and paste the infection command.

What to Do Now

• Verify ad authenticity even from verified accounts: corporate badge compromise is documented and growing
• Never paste commands from websites into Terminal or Run dialog, regardless of the purported source or urgency of the message
• Monitor for anomalous TLS SNI communications: a client presenting facebook.com while contacting non-Facebook IPs indicates active spoofing
• Adapt detection for blockchain-based infrastructure: traditional indicators (domains, IPs) fall short when C2 resides on BSC smart contracts

Frequently Asked Questions

Was HBO Max hacked?
No. The verified Reddit account u/hbomax was compromised, not HBO Max's streaming infrastructure or internal systems.

Are there confirmed victims?
The dossier does not specify the number of victims or affected geographic entities. Infection mechanisms are documented, not the extent of actual compromise.

Is the campaign still active?
Reddit suspended the ads and opened an internal investigation. The dossier does not indicate whether the account was recovered or permanently disabled.

The PasteSwitch operation demonstrates that social platform account hijacking is no longer an end in itself, but a component of a modular delivery system spanning operating systems, malware families, and infrastructure generations. The true objective is not isolated credential theft: it is the demonstration that a single verified account, armed with techniques like ClickFix and blockchain C2, can erode trust in entire advertising ecosystems.

Sources

• https://www.infostealers.com/article/hbo-max-ads-on-a-compromised-reddit-account-exposed-a-massive-pasteswitch-clickfix-operation/
• https://mallory.ai/stories/01a0a079-0d9c-79d1-9d8f-e76c02c256ea
• https://www.hudsonrock.com/
• https://adamnet.works/blog/hbo-max-ads-exposed-the-pasteswitch-clickfix-operation/