Hackers hijacked HBO Max’s verified Reddit account and used it to distribute malicious advertisements. The ads targeted Windows and macOS users with ClickFix attacks designed to install information-stealing malware.
Researchers identified 108 malicious ads posted over around 48 hours. Some impersonated HBO Max, while others promoted fake AI tools, developer software and system utilities.
Hackers Hijack Verified Reddit Account
Researchers from Hudson Rock and ADAMnetworks investigated the campaign. They found that attackers had taken control of the verified u/hbomax Reddit account.
The criminals then used the trusted profile to publish 108 advertisements. Because the ads came from an official, verified account, they appeared more credible to Reddit users.
Some advertisements promoted a supposed native HBO Max application for macOS. However, HBO Max does not offer the software shown in the campaign.
Other ads targeted a wider audience with fake AI platforms, developer tools and macOS utilities. Therefore, the operation extended beyond users of the streaming service.
Researchers identified 40 ads linked to hbomaxx[.]app. Another 36 promoted the fake AI and development website codex-craft[.]com.
Meanwhile, 15 ads directed users to apple.clean-disk-guide[.]com. Eleven promoted code-desktop[.]com, while six pointed to hbomax-macos[.]com.
Fake HBO Max App Uses ClickFix
The HBO Max malware campaign used a social engineering method known as ClickFix. These attacks display instructions that claim to solve a technical problem or install legitimate software.
However, the instructions tell users to copy and paste a malicious command into an operating system tool. Attackers commonly target Windows Run, PowerShell and the macOS Terminal.
This method has become popular because victims execute the commands themselves. Consequently, the attack may bypass browser protections and security tools that monitor conventional malware downloads.
The campaign first attracted attention after a Reddit user noticed an ad from the verified HBO Max profile. It promoted what appeared to be an official macOS application.
Clicking the advertisement redirected the user to a convincing fake HBO Max website. One domain used for this purpose was hbomaxx[.]us.
The site displayed a download button. Yet clicking it did not download an application. Instead, the page instructed visitors to open Terminal and paste a command.
Malicious Command Downloads Mac Malware
One macOS command used Base64 encoding to conceal its true purpose. After decoding, researchers found that it downloaded and executed a shell script from attacker-controlled infrastructure.
Hudson Rock connected the delivery domain to a broader campaign active in September. Researchers named this operation PasteSwitch.
The campaign delivered MacSync malware in some attacks. MacSync can steal browser credentials, Firefox profiles, Telegram data, Apple Notes and macOS passwords.
Another infection chain installed a tool called AMOS helper. It established persistence through a directory that imitated the name of a legitimate Apple service.
The malware could then register the infected computer with an attacker-controlled server. This connection allowed the criminals to send additional tasks to the compromised device.
Campaign Targets Cryptocurrency Wallets
PasteSwitch has also distributed fake versions of popular cryptocurrency wallet applications. The counterfeit software impersonated Ledger, Trezor Suite and Exodus.
These malicious applications attempted to steal wallet recovery phrases. Anyone with access to such a phrase may gain control of the associated cryptocurrency wallet.
Moreover, the campaign delivered cryptocurrency clipboard hijackers such as AnimateClipper and ZigClipper. This malware monitors copied wallet addresses and replaces them with addresses controlled by criminals.
A victim may then unknowingly send cryptocurrency directly to the attacker.
Researchers chose the PasteSwitch name because victims paste attacker-supplied commands into their devices. Meanwhile, the operation’s backend switches between platforms, payloads and cryptocurrency theft techniques based on each visitor.
Windows Attacks Use PowerShell
The campaign also targeted Windows computers. In these attacks, fake instructions directed victims to execute commands through mshta and PowerShell.
One infection chain used a file that functioned as both an MP3 and an HTA application. It created a scheduled task and launched the 32-bit version of PowerShell.
The attack then attempted to disable Microsoft’s Antimalware Scan Interface. Additionally, it generated victim-specific infrastructure using the computer name and username.
Later stages used heavily disguised PowerShell commands and shellcode. These components loaded Amatera Stealer directly into memory without saving the final payload to the device first.
This technique can make detection more difficult because fewer malicious files appear on the computer’s storage.
Reddit Stops the Malicious Ads
Researchers reported that the compromised account supported a much larger advertising operation. Its various ads targeted streaming customers, developers, AI users and people searching for system utilities.
After users reported the campaign, a Reddit administrator paused the malicious advertisements. Reddit also referred them to its Security and Safety teams for further investigation.
However, researchers have not explained how the hackers gained control of the verified HBO Max account. It also remains unclear whether they compromised any other accounts or systems belonging to HBO or Warner Bros. Discovery.
Neither company had responded to questions about the incident at the time of reporting.
0 responses to “HBO Max Malware Ads Spread Through Hacked Reddit Account”