# Hackers Exploit Verified Streaming Accounts to Spread Malware Cybercriminals hijacked HBO Max's official Reddit account to push malicious ads. - **Source:** [Technology News Articles on Fox News](https://www.foxnews.com/tech) - **Published:** 2026-09-23 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/d108ec9f-089d-41fc-8908-ea389f49f464 ## Verified account compromise Cybercriminals hijacked HBO Max's official, verified Reddit account to distribute 108 malicious ads over 48 hours. The ads promoted fake HBO Max downloads alongside AI tools and developer software. The verified status lowered victims' suspicion, demonstrating how attackers exploit trusted corporate identities. This incident highlights the growing sophistication of social engineering tactics in cyber attacks. ## ClickFix attack mechanism The campaign used ClickFix, a technique where victims execute malicious code themselves. Instead of direct downloads, users were instructed to paste commands into Terminal. This bypasses traditional download protections by making the victim perform the final attack step. The method pretends to fix installation issues or complete CAPTCHAs, appearing as legitimate troubleshooting while delivering malware. ## Multi-platform payload delivery The PasteSwitch operation adapted attacks based on victim's OS. Mac users faced credential-stealing payloads like MacSync, while Windows users received PowerShell-based attacks loading malware directly into memory. The system could change delivery based on platform, visitor profile, and campaign stage, making detection harder. Researchers found 36 command-and-control domain changes between March-July 2026. ## Cryptocurrency wallet targeting Attackers distributed fake versions of Ledger, Trezor Suite, and Exodus wallet apps designed to steal recovery phrases. The operation also included clipboard hijackers that replace cryptocurrency addresses during transactions. These components show the campaign's financial motivation, targeting both general users and cryptocurrency holders through sophisticated, multi-stage attacks. ## Technical evasion tactics The malware used Binance Smart Chain contracts to retrieve changing command domains, maintaining operational resilience. Some Windows variants disguised traffic as Facebook communications to evade network monitoring. These techniques demonstrate professional-grade infrastructure designed for persistence and evasion, suggesting organized cybercrime rather than opportunistic attacks. ## Corporate account vulnerabilities The attack exploited Reddit's advertising system where verified accounts can run paid promotions. While Reddit locked the compromised account and removed ads, the incident reveals vulnerabilities in platform-level verification systems. Corporate accounts become high-value targets as they provide built-in credibility that attackers can weaponize. ## Endpoint protection bypass By having victims paste commands directly, attackers bypass file-based detection systems. Some payloads injected directly into memory without writing to disk, defeating traditional antivirus scans. macOS Tahoe 26.4 introduced warnings for suspicious pasted commands, but attackers continuously adapt their techniques to circumvent new protections. ## Credential harvesting impact The Mac payloads could steal browser credentials, Telegram data, Apple Notes, and system passwords. This data enables follow-on attacks across multiple services. The operation maintained persistence through AMOS helper chains, showing long-term access objectives beyond initial infection. Such comprehensive data collection enables identity theft and financial fraud. ## Industry response measures Reddit's response included account lockdown, ad removal, and security collaboration with HBO Max. Apple added Terminal warnings for suspicious commands in recent macOS updates. However, the rapid evolution of these attacks requires continuous security updates and user education to maintain effective defenses against increasingly sophisticated social engineering tactics. ## User protection strategies Critical defenses include avoiding direct ad clicks, verifying downloads through official sources, and rejecting requests to paste unfamiliar commands. Multi-factor authentication limits credential misuse, though some malware bypasses these protections. Regular software updates and endpoint protection provide additional layers of security against evolving attack methods. ## Sources covering this story - https://www.foxnews.com/tech/hackers-hijack-verified-streaming-account-spread-malware — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._