You probably know to be suspicious of a strange pop-up or a random website asking you to download something. But what happens when the ad comes from a verified account belonging to a company you recognize? That is what made a recent malware campaign involving HBO Max so concerning.
Researchers at Hudson Rock found that cybercriminals hijacked HBO Max’s official, verified Reddit account and used it to push 108 distinct malicious ads over roughly 48 hours. The ads promoted HBO Max downloads along with AI tools, developer software and Mac utilities. Because they appeared under a verified corporate account, potential victims had one less reason to question what they were seeing.
You do not need HBO Max to be exposed to this type of attack. The larger lesson involves how criminals can borrow credibility from verified accounts and familiar companies to get people to lower their guard. And once you click, the attack can take a surprisingly simple turn.
NEW! 🩺 Free CyberGuy LIVE class: Get Better Healthcare With AI Saturday, September 26 at 11 a.m. ET / 8 a.m. PT
Kurt “CyberGuy” Knutsson will show you five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor. No technical experience is needed.
Save your free spot at CyberGuyLive.com.
Register and receive the replay and step-by-step guide afterward.
SCAMMERS ARE BUYING GOOGLE ADS TO STEAL BANK LOGINS
The incident first surfaced after a Reddit user spotted an advertisement posted by the verified u/hbomax account. The ad promoted what appeared to be a native HBO Max application for macOS. HBO Max does not currently offer a native app for Mac computers. Its support page directs Mac users to stream at HBOMax.com. The user followed the advertisement to a convincing landing page. However, clicking the download button did not start a normal file download. Instead, the website displayed a prompt telling the visitor to copy and paste a command into Terminal. That request should immediately raise a red flag. Elsewhere in the broader PasteSwitch operation, Windows users could be routed through Run or PowerShell-based attack paths. Researchers found that the Windows branch could use PowerShell and other tools to eventually load malware directly into memory.
The technique behind the campaign is known as ClickFix. Rather than relying entirely on a malicious download, ClickFix gives you instructions that lead you to execute the attack yourself. The prompt may pretend that something went wrong with a CAPTCHA. Another version may claim you need to fix a browser problem or complete an installation. A malicious webpage can even place a command onto your clipboard. Then it tells you where to paste it. That little sequence can feel like ordinary troubleshooting, especially when the page looks professional and the ad came from an account you trusted. In the HBO Max campaign, Hudson Rock says the technique relied on getting the victim to execute attacker-supplied code through Terminal. That approach can bypass some protections designed to stop malicious browser downloads. The warning sign I want you to remember is simple: A website should never need you to paste an unfamiliar command into Terminal, PowerShell or the Windows Run box to prove you are human or install ordinary consumer software.
The fake HBO Max download was only part of what researchers uncovered. Hudson Rock says attackers used the compromised Reddit account to push 108 distinct advertisements during the roughly 48-hour campaign. The ads shifted between multiple software lures as domains were taken down or abandoned. The researchers counted:
That rapid switching shows how attackers can reuse the credibility of one compromised account while changing the websites and software names placed in front of victims.
Hudson Rock and researchers from ADAMnetworks connected the HBO Max campaign to a broader operation they call PasteSwitch. The name describes what stays consistent across the operation: victims paste a command supplied by the attacker while the delivery system changes what comes next based on the visitor, platform and campaign.
That means two people clicking similar malicious ads may not necessarily receive the same malware. On Macs, researchers found several PasteSwitch payload paths. MacSync could steal browser credentials, Gecko browser profiles, Telegram data, Apple Notes and macOS passwords. Researchers also documented an AMOS helper chain that could maintain access to an infected device.
Another part of the operation used fake versions of cryptocurrency wallet apps, including Ledger, Trezor Suite and Exodus. Those fake apps were designed to steal 12- and 24-word cryptocurrency wallet recovery phrases. That means one bad command could expose far more than the browser tab you were looking at.
CLICKLOCK MAC MALWARE LOCKS APPS UNTIL YOU GIVE IN
PasteSwitch could also recognize Windows visitors and change its attack. Researchers found a Windows branch that used mshta and PowerShell. One route delivered a malicious file disguised in an MP3/HTA format before creating a scheduled task and launching PowerShell.
Later stages could inject the Amatera Stealer directly into memory without first writing the final malware to disk. Researchers also found a technique designed to make malicious traffic appear as though it were communicating with Facebook, potentially making basic network monitoring less useful. That level of technical complexity sits behind a remarkably simple first step: convincing someone to paste a command.
Researchers connected PasteSwitch to another dangerous tool: cryptocurrency clipboard hijackers. The operation delivered malware known as AnimateClipper and ZigClipper. These tools can monitor the clipboard and replace cryptocurrency addresses when a victim copies or pastes them.
So, you might carefully copy the correct wallet address, paste it into a transaction and unknowingly send the money somewhere else. Researchers also found that the malware used Binance Smart Chain contracts to retrieve changing command-and-control domains. Between March and July 2026, researchers observed 36 changes made by the same attacker-controlled address. That helped the operation keep switching infrastructure as domains became unusable.
Most of us make quick trust decisions online. A recognizable company name can make an ad feel safer. A verification badge adds credibility. When both appear together in a paid advertisement, the whole thing can look vetted. But verified accounts can still get compromised.
Hudson Rock says the attackers took advantage of HBO Max’s trusted advertising identity during the campaign. The polished assets also helped lower the skepticism people might normally apply to an unknown online advertisement. That changes how we need to think about ads.
If an advertisement offers software you want, open a new browser tab and find the company’s official website yourself. For apps, check your device’s official app store. Those extra few seconds could stop the attack before it reaches your computer.
Reddit has now confirmed that an HBO Max account authorized to run advertisements on its platform was compromised and used to distribute malicious links. In a statement provided to CyberGuy, Reddit said:
“We recently learned that an HBO Max account authorized to run advertisements on Reddit was compromised and used to run ads containing malicious links. After learning of the issue, we locked the account, removed the ads and began working with HBO Max to strengthen its account security. At this time, we have not identified any impact to other Reddit advertising accounts.”
We also reached out to HBO Max for comment but did not hear back before our deadline.
ClickFix has spread quickly because the attacker convinces the victim to take the final action. Huntress says ClickFix accounted for 53% of the malware loader activity it observed during 2025, based on its endpoint and identity telemetry. Attackers also keep changing the lure.
We have already seen fake CAPTCHA prompts spread through thousands of compromised websites and bogus Windows updates use similar techniques. Compromised websites can also display fake verification prompts designed to push visitors toward dangerous commands. The design may change next week. The request to run an unfamiliar command remains the behavior to watch for.
Apple has added another layer of protection against some ClickFix attacks. On macOS Tahoe 26.4 or later, Terminal may warn you when pasted text resembles a potentially harmful command. The warning explains that scammers sometimes persuade people to paste commands that can compromise their Mac or privacy. That protection can help, but users may not see a warning for every malicious command. Attackers also continue adjusting their techniques. Your own judgment still plays a major role.
‘THE ODYSSEY’ STREAMING SCAM COULD STEAL YOUR BANK INFO
A convincing ad can get anyone’s attention. These steps can help you recognize the warning signs before one bad click turns into a bigger problem.
A familiar logo or verification badge cannot guarantee that the person controlling the account today is the legitimate owner. When possible, visit the company’s official website directly instead of clicking an ad.
If a webpage asks you to open Terminal, PowerShell or the Run dialog and paste something, close the page. Ordinary consumer software rarely requires you to run an unfamiliar command manually.
Use the developer’s official website or your device’s app store. Be especially careful when an advertisement suddenly offers a desktop application or special download you have never heard of.
Some ClickFix pages can copy malicious text onto your clipboard. If your browser or security software warns that a site copied something unexpectedly, take that warning seriously.
Security updates can add protections against newer attack techniques. Install updates through your operating system settings or the software’s built-in updater.
Strong antivirus software can help block malicious websites and detect malware if an attack gets past your browser. It gives you another layer of protection when a convincing page slips through.
Disconnect the computer from the internet and run a full security scan using trusted antivirus software. From a clean device, change passwords for sensitive accounts, starting with your primary email account. Then review financial accounts and cryptocurrency wallets for activity you do not recognize.
An infostealer may capture passwords and browser information. Multifactor authentication can make stolen credentials harder to use, although some session-stealing malware can get around normal login protections.
What caught my attention here was how quickly something dangerous could start to feel legitimate. The advertisement came from a verified corporate account. The page looked polished. Then the instructions presented themselves as a normal installation step. That combination can get past the skepticism many of us have learned to apply to obviously shady emails and suspicious websites. So I would focus less on how professional an advertisement looks and more on what it asks you to do next. The moment a website tells you to open Terminal, PowerShell or another system utility and paste an unfamiliar command, stop. Hackers will keep looking for ways to borrow the reputation of companies people already trust. We need to adjust our instincts as those attacks change.
Would you still trust an online ad because it came from a verified company account, or has this changed the way you decide what is safe to click? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
