Hackers Hijack HBO Max Reddit Account to Spread Malware Through Fake Ads

Hackers have reportedly compromised the official HBO Max Reddit account and used it to distribute malicious advertisements. The campaign targeted both Windows and macOS users with a social engineering technique known as ClickFix.

Security researchers from Hudson Rock and ADAMnetworks found that the verified u/hbomax account published 108 malicious advertisements over roughly 48 hours. The ads directed users to fake websites and attempted to trick them into running harmful commands on their computers.

Hackers Hijack HBO Max Reddit Account to Spread Malware Through Fake Ads

The attackers relied on a technique called ClickFix. It works by convincing users that they need to perform a simple action to fix an error, complete a CAPTCHA verification, or install legitimate software.

Instead of downloading a genuine application, victims are instructed to copy and paste a command into Windows Run, PowerShell, or macOS Terminal.

Because the victim runs the command themselves, the attack can bypass some security protections that normally detect suspicious downloads. This has made ClickFix increasingly popular among cybercriminals.

Fake HBO Max App Used to Target Mac Users

The campaign was first noticed when a Reddit user discovered an advertisement posted by the verified HBO Max account. The ad promoted what appeared to be an official HBO Max application for macOS.

Users who clicked the advertisement were sent to a website designed to look like a legitimate HBO Max service. One of the websites identified by researchers was hbomaxx[.]us.

Instead of providing a genuine application, the site instructed visitors to open Terminal and paste a command. Following the instructions could install information-stealing malware on the Mac.

Researchers found that some of the commands were also disguised using Base64 encoding. This made the commands more difficult for ordinary users to understand.

Malware Can Steal Sensitive Information

The campaign distributed several types of malware. One of them was MacSync, which can target sensitive information stored on macOS devices.

Researchers said MacSync can steal browser credentials, Firefox profiles, Telegram information, Apple Notes data, and macOS passwords.

Another malware strain, known as AMOS helper, was also used in some attack chains. It can establish persistence on an infected Mac and allow attackers to communicate with compromised systems.

The campaign also promoted fake cryptocurrency wallet applications. These included fake versions of Ledger, Trezor Suite, and Exodus that were designed to steal cryptocurrency wallet recovery phrases.

Windows Users Were Also Targeted

The campaign was not limited to Apple devices. Windows users were also targeted with malicious instructions involving PowerShell and other built-in Windows tools.

Researchers observed attack chains that used mshta and PowerShell to execute malicious code. Some attacks used techniques designed to make detection more difficult.

The attackers were also observed deploying Amatera Stealer, an information-stealing malware capable of collecting data from infected systems.

Other parts of the campaign distributed clipboard-hijacking malware. These threats can monitor copied cryptocurrency addresses and replace them with addresses controlled by attackers, potentially redirecting cryptocurrency payments.

See Also: Netflix to Require HBO and Warner Bros. Studios in Mega Deal

Campaign Used Multiple Fake Websites

The attackers did not focus only on HBO Max users. They used several advertisements to target different groups, including developers and people searching for AI tools and system utilities.

Researchers identified 40 ads linked to hbomaxx[.]app. Another 36 advertisements promoted a fake AI and developer website called codex-craft[.]com.

The campaign also included ads promoting fake macOS utilities and developer software. This allowed the attackers to reach a much wider audience through the compromised account.

Security researchers linked the activity to a larger operation called PasteSwitch. The campaign can change the malware, target platform, and attack method depending on the visitor.

Reddit Took Action Against the Ads

After the malicious advertisements were reported, a Reddit administrator paused the ads and forwarded the incident to Reddit’s security and safety teams.

It is still unclear how the attackers gained access to the official HBO Max Reddit account. There is also no confirmation about whether other HBO or Warner Bros. Discovery accounts or systems were compromised.

The incident highlights the risks of trusting verified social media accounts without checking the links and instructions they share. Users should avoid copying commands into PowerShell, Terminal, or other system tools simply because a website claims that the action is required to fix an error or complete a verification process.