HBO Max's Reddit Account Hijacked in Malvertising Campaign
Attackers used the verified account to distribute malware through fake HBO Max and OpenAI ads.
1Account Compromise Details
The official HBO Max Reddit account was hijacked and used to post over 100 malicious ads promoting fake HBO Max and OpenAI applications. These ads directed users to download malware disguised as legitimate software. The attack was discovered on September 6 by a Reddit user who noticed the verified HBO Max account posting suspicious content. The streaming service doesn't offer a native Mac client, making the fake macOS app advertisement particularly suspicious.
2Malware Delivery Mechanism
Clicking the malicious ads led victims to a convincing-looking fake HBO Max website (hbomaxx.us). The site prompted users to copy and paste a Terminal command - a classic ClickFix attack vector for macOS. Security researchers tested the payload in sandboxed environments, confirming it delivered information-stealing malware. The attack targeted both Windows and macOS users, with payloads tailored to each operating system.
3Campaign Scale and Targets
Researchers identified this as part of a 48-hour malvertising blitz called PasteSwitch, which distributed 108 distinct malicious ads. Besides HBO Max, attackers used fake OpenAI Codex ads (36 instances), disk utilities (15), and developer tools (11) as lures. Nearly half (46) of the ads impersonated HBO Max, directing users to domains like hbomaxx.app. The campaign demonstrates how attackers exploit trusted brands to distribute malware.
4Malware Payload Analysis
The PasteSwitch campaign delivered various malware types based on victims' OS: infostealers, loaders, cryptocurrency clippers (AnimateClipper/ZigClipper), and fake crypto wallets. The crypto clippers used Binance Smart Chain contracts for dynamic command-and-control, making infrastructure resilient to takedowns. Researchers observed 36 mainnet changes by the same attacker between March-July 2026, showing sophisticated blockchain abuse.
5Industry Response
Reddit paused the malicious ads three days after discovery and launched an investigation. Warner Bros. Discovery (HBO Max's parent) hasn't commented on the account takeover. Security firm Hudson Rock noted this incident highlights why trusted distribution channels are prime targets for malware delivery. The attack shows ClickFix social engineering remains prevalent in cybercriminal tactics.
6Technical Sophistication
The attackers demonstrated advanced techniques by hosting command-and-control infrastructure on blockchain (Binance Smart Chain). This allows dynamic domain rotation when domains get burned, making takedowns difficult. The campaign's use of multiple lures (HBO Max, OpenAI, disk utilities) shows careful targeting of different user demographics interested in entertainment or development tools.
7Historical Context
This isn't the first time attackers have abused trusted platforms for malware distribution. Previous campaigns have similarly hijacked verified social media accounts or abused advertising networks. The HBO Max incident follows a pattern of criminals increasingly targeting the
8Security Implications
This attack underscores the growing risk of supply chain compromises in digital distribution. Even verified accounts on trusted platforms can't be assumed safe. Organizations must implement stronger social media account protections and monitor for unauthorized activity. For users, it highlights the need for skepticism even when content appears to come from verified sources, especially when prompted to run commands or downloads.