HBO Max Reddit Account Hijacked to Push 108 Malware Ads Targeting Crypto Wallets
Share
Key Takeaways
Hackers hijacked HBO Max’s verified Reddit account and pushed 108 malicious ads in roughly 48 hours.
The PasteSwitch campaign targeted Windows and macOS users with information stealers, crypto clippers, and counterfeit wallet applications.
Reddit locked the compromised account and removed the ads, but the number of victims and any crypto losses remain unknown.
Hackers turned HBO Max’s verified Reddit account into a malware distribution channel, running 108 malicious advertisements in roughly 48 hours that targeted passwords and cryptocurrency wallets.
Security researchers at Hudson Rock and ADAMnetworks linked the attack to a broader campaign they call PasteSwitch, which delivered different malware depending on whether a victim was using Windows or macOS.
‼️ BREAKING: The official HBO Max Reddit account was hijacked and ran malvertising with a ClickFix attack on Reddit for 48 hours, pushing macOS malware to users.
The ad led to a convincing HBO Max landing page where the download button started no download. Instead it produced a… pic.twitter.com/vR34Na9QDt
The breach gave attackers something particularly valuable: the credibility of an established company’s verified account.
Try Our Recommended Crypto Exchanges
Sponsored
Disclosure
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
The campaign surfaced after a Reddit user spotted an advertisement from the verified u/hbomax account promoting an HBO Max application for macOS. HBO Max does not offer such a native Mac app.
Malicious HBO Max advertising on Reddit. | Source: BleepingComputer
Clicking the ad sent users to a convincing imitation website. Instead of downloading software, visitors were instructed to copy a command and run it through macOS Terminal.
The technique, known as ClickFix, gets victims to execute malicious code themselves rather than relying on a conventional malware download. Windows versions used tools including PowerShell and the Run dialog.
Researchers found the campaign went far beyond a fake streaming app. Of the 108 advertisements, 46 used HBO Max-themed lures, 36 impersonated AI coding software, 15 promoted a fake Mac disk utility and 11 used other developer-tool themes.
Crypto Wallets Were Directly Targeted
Once installed, the malware could steal browser credentials, cookies and other sensitive information.
The operation also deployed AnimateClipper and ZigClipper, malware designed to replace copied cryptocurrency addresses so funds can be redirected to attacker-controlled wallets.
Researchers also identified counterfeit cryptocurrency wallet applications designed to capture recovery phrases.
The attackers even used Binance Smart Chain smart contracts as part of their command-and-control infrastructure. Hudson Rock identified 36 onchain changes between March and July 2026 linked to the same controller address, allowing the malware infrastructure to rotate domains.
Reddit told TechCrunch that the HBO Max advertising account had been compromised and used to distribute malicious links. The platform subsequently locked the account and removed the ads.
How the account was initially compromised remains unclear. More importantly for crypto users, researchers have not established how many people installed the malware or how much cryptocurrency, if any, was stolen.
Disclaimer:
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
