ADAMnetworks

A compromised HBO Max account led to PasteSwitch, a cross-platform ClickFix operation spanning macOS stealers, Windows loaders, deceptive TLS, and contract-controlled clippers.

In September 2026, a compromised official HBO Max account published 108 ads over 48 hours. The ads sent macOS users to fake software pages that copied attacker commands into Terminal. Hudson Rock’s infostealer research established the incident and its scale. In our joint research, we used the copied command as the starting point for an investigation into the machinery behind it.

Following that command exposed PasteSwitch, a cross-platform delivery operation spanning MacSync, AMOS, Amatera, fake wallet apps, and contract-controlled cryptocurrency clippers. The research moved from one advertising account into encrypted loaders, platform-aware routing, persistent macOS implants, in-memory Windows execution, deceptive TLS identity, infrastructure provisioning, and synchronized smart contracts.

Joint research with Hudson Rock

Additional thanks to Tuxxin from Whack.sh and Emiliano from The Matrix Project for their help researching the finer infrastructure details.

A verified account delivered 108 malicious ads

The HBO Max lure at hbomaxx[.]us . Source: Hudson Rock investigation, September 2026.

The download button opened a ClickFix prompt that told the visitor to copy a command, open Terminal, paste the command, and run it. This transferred execution from the browser to a trusted system utility under the victim’s control.

The HBO Max campaign covered 108 ads across five lure groups during the 48-hour window:

The account gave the ads a trusted identity while the destination domains, copied commands, and payload infrastructure remained under attacker control. administrators later paused the ads and opened a security investigation.

A administrator confirmed that the advertising activity had been paused. Source: Hudson Rock investigation, September 2026.

The active Alfred lure presented a copied Terminal command to a qualifying macOS visitor. Source: joint research, September 2026.

That live Alfred path supplied the initial command and payload needed to continue the technical investigation after the HBO Max delivery had ended.

The copied command opened the technical investigation

The preserved HBO material printed a legitimate-looking App Store address before its hidden execution path. The live Alfred page used the same copied-command model. Its Base64 content decoded to a remote shell-script request:

The ClickFix prompt shown by the HBO Max lure. Source: Hudson Rock investigation, September 2026.

Decoding the Alfred copy field exposed the Ember Bridge setup route. Source: joint research, September 2026.

Two additional September routes used the same host and loader structure:

The recovered script from ember-bridge[.]com reconstructed commands including md5 , xxd , openssl , and gunzip . It decrypted embedded content with AES-128-CTR, expanded the result, and executed the zsh stage.

That stage reported successful execution to:

It then downloaded a native macOS payload from an update-style route:

The payload was written to /tmp/.u43v97pb , stripped of extended attributes with xattr -c , marked executable, and launched. Its SHA256 was:

The recovery sequence connected the original ad campaign to a live lure and final executable:

The September payload stole credentials and persisted

Static analysis and macOS execution showed collection of Chromium and Firefox credentials and cookies, Keychain material, Apple Notes, shell history, SSH material, wallet data, messenger data, password-manager data, and selected files. The payload used 165.22.199.85 for telemetry and exfiltration. Its observed progress values included started , init_session , messengers , credentials , browsers , wallets , and passmgr . It then contacted rudder-moss[.]com , wuess[.]com , and 164.90.161.147:80 .

wuess[.]com/api/feed/items/1c6bcaad7aa6a3ece63dadfba246def0 returned a 1,718-byte configuration containing 21 cryptocurrency replacement addresses. This runtime set differed from the 21-address Animate and Zig fallback set described later in this article.

Persistence components were placed under directories named to resemble Apple services:

The three recovered persistence components had SHA256 values:

The same execution pattern had appeared in fake developer-tool and Homebrew campaigns. Cato Networks documented encrypted helper delivery, event=pasted telemetry, and update-style routes in a fake Codex campaign. Independent research by lostsh documented the same loader grammar in a fake Homebrew campaign.

One route identifier made the continuity especially clear. The September and Cato strings are 43 characters and differ by one character:

Both chains used encrypted or compressed zsh, execution telemetry, /tmp staging, xattr -c , chmod +x , and native helper execution. The changed sequence is FNmchn in September and FNtchn in the Cato route.

The investigation expanded into PasteSwitch

The HBO Max ads provided one entry into a larger delivery system. Recovered pages and payloads showed separate services for lures, visitor qualification, staging, telemetry, payload delivery, C2, and exfiltration.

We track that operation as PasteSwitch. The name describes the stable action at the center of each route: the victim pastes an attacker-supplied command, and the delivery system switches among platform, campaign, payload, and monetization branches.

The same structure appeared behind fake Claude, Codex, Alfred, HBO Max, Homebrew, utility, GitHub, and wallet applications. The payload selected after the pasted command included MacSync, AMOS helpers, fake wallet applications, InstallFix, Amatera, AnimateClipper, and ZigClipper.

Each service had a defined role

The infrastructure predates the HBO Max ads

PasteSwitch qualifies visitors before delivery

PasteSwitch front ends inspect the visitor before revealing a command. Captured gates collected browser, hardware, display, runtime, and page-context data.

Qualifying macOS visitors received a lure and copied Terminal command. Other profiles received blank pages, parked content, vendor redirects, browser-extension pages, VPN pages, or unrelated templates.

We directly observed alfredaps[.]com serving the malicious Alfred page to a Mac while redirecting a Windows sandbox to the legitimate Alfred website. The captured storageprofiler[.]com page used XOR-wrapped JavaScript and a ChaCha20-encrypted configuration. Its gate required Apple classification, at least ten input events, and two seconds of interaction before revealing its copied command.

Microsoft documented more than 250 front ends in a gated macOS ClickFix cluster. The server-side checks included browser, screen, window, WebGL, timezone, iframe, touch, developer-console serialization, and prototype-tamper signals. Microsoft’s 17 published domains and Zscaler’s 207-domain MacSync corpus contain 224 unique domains with zero exact overlap, illustrating how rapidly the front-end inventory changed around stable delivery behavior.

This gate explains why the same address can produce a malicious page for one visitor and benign content for another. It also explains empty automated scans and captures that end at legitimate vendor pages.

Eight lure pages preserved their copied commands

Eight recovered pages preserved complete lure-to-command routes:

Each command sent the downstream response into zsh . The route token survived changes to the presenting domain and often provided a stronger link than the lure brand.

The macOS routes delivered distinct theft systems

The September payload led into several macOS branches. Each branch collected overlapping data, while its request grammar, staging files, and upload protocol remained distinct.

MacSync used transaction tokens and chunked uploads

MacSync followed a repeatable route sequence:

Recovered MacSync code collected browser credentials and cookies, Gecko profiles, wallets, Telegram data, Apple Notes, Keychains, cloud credentials, shell history, system data, and the macOS password. It staged the result in /tmp/osalogging.zip and sent roughly 10 MB HTTP PUT chunks with upload_id , chunk_index , and total_chunks .

The same API key remained embedded across independently recovered controller scripts:

A secondary telemetry key also repeated across the branch:

Exact executions preserved activity at houstongaragedoorinstallers[.]com , dogtrainersgeorgia[.]com , aidevmaster[.]com , restoremental[.]com , glowmedaesthetics[.]com , and marbellaresales[.]com .

Recovered shell stages preserve the wider delivery estate:

Two older MacSync Mach-O samples retained the downloader identity UserSyncWorker/1.0 (macOS) and the route gatemaden[.]space/curl/985683bd660c0c47c6be513a2d1f0a554d52d241714bb17fb18ab0d0f8cc2dc6 :

Zscaler connected 207 domains to MacSync and its Claude-themed delivery. Microsoft later connected more than 30 domains through the same /curl/ , /dynamic?txd= , /gate?buildtxd= , API-key, and upload behavior. RST Cloud documented overlapping C2 windows and the same controller grammar.

The AMOS helper enrolled victims for continuing tasking

The Arkypc branch began with a 229-byte loader:

It downloaded arkypc[.]com/n8n/update to /tmp/helper , cleared extended attributes, added execute permission, and ran the native helper. The historical helper had SHA256 e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c .

The exact April distribution route was:

The helper checked for virtualized environments, requested and validated the macOS password, collected credentials and application data, created /tmp/out.zip , uploaded the archive, installed persistence, and accepted arbitrary zsh tasks.

Its upload protocol used multipart POST requests to / in chunks up to 25 MiB:

The persistent components used:

The implant then enrolled with a plaintext task service at 45.94.47.204:80 :

A captured task copied Keychain and browser cookie data, archived it, and uploaded the result to mpasvw[.]com/api/cookies with the victim’s bot_uid .

The same helper-delivery grammar appeared across Arkypc, Harbor/Verse, Cato, lostsh Homebrew, and the September activity. fern-plume[.]com supplied the helper update route while node-slate[.]com supplied the paired /api/metrics/run?event=pasted route. Harbor and Verse preserved the same role split: harbor-29[.]com delivered the shell and native helper, while verse-18[.]com received execution telemetry.

The April 22 packet capture and samples preserve the exact Arkypc helper chain. Field Effect observed the same route after a malicious prompt caused a Cursor agent to execute the commands.

Download through exfiltration took less than two minutes. A-Packets documented the task that collected Keychain and browser data, while PcapAI published a protocol-focused analysis of the same AMOS traffic.

Fake wallet applications stole recovery material directly

loop-lumen[.]com/zxc/ distributed fake Ledger, Trezor Suite, and Exodus applications for macOS:

The Swift and SwiftUI applications used WKWebView, universal x86_64 and arm64 binaries, ad hoc signing, Base64-obfuscated JSON fields, and fake failure messages before redirecting victims to the legitimate vendor. They sent collected data to umapla[.]com and glrack[.]com .

Recovered collector routes included:

The /zxc/app.zip , /zxc/apptwo.zip , and /zxc/appex.zip convention also appeared in the AMOS helper wallet-replacement workflow described in Microsoft’s macOS ClickFix research .

Filequanticore reused the copied-command model

filequanticore[.]com and filesiriuscore[.]com served the same 12,282-byte macOS Terminal-copy page across nine captures: eight from Filequanticore and one from Filesiriuscore. The page title was Download for macOS - DMG or via bash . The visible page advertised a DMG while JavaScript loaded the copied command from links/data.txt .

The decoded path was:

The recovered resources were hash-bound:

The page, JavaScript, copied-command data, and decoded route establish the complete edge from the lure into its shell stage.

Windows visitors received InstallFix and Amatera

The recovered cladesktop[.]gitlab[.]io/releases/ lure selected Arkypc for macOS visitors and displayed a Windows command using:

The /app response was an MP3/HTA polyglot preserved in its VirusTotal community record , with SHA256:

A /claude sibling used the same InstallFix MP3/HTA carrier format and is preserved under its own VirusTotal record :

The PowerShell chain loaded Amatera in memory

The HTA created a one-shot scheduled task named servicedae , launched 32-bit PowerShell, disabled AMSI, calculated a victim-specific subdomain, and requested:

The victim label was the lowercase first 16 hexadecimal characters of MD5(UTF8(COMPUTERNAME + USERNAME)) , giving the operator a stable per-host staging name.

The stage used arithmetic fog, dead loops, opaque predicates, a 21-second delay, Base64, repeating-key XOR, rolling decoding, shellcode, an x86 unpacker, and in-memory PE loading. Stable markers included the RC4 key BWJFEesMEqRvjQbm , the XOR key AMSI_RESULT_NOT_DETECTED , and the array @(989,145,425) .

The 2,473-byte PowerShell command recovered from process telemetry had SHA256:

The loader allocated memory, copied a 129,623-byte x86 shellcode payload, changed the region from writable to executable, and started it with NtCreateThreadEx . The recovered shellcode had SHA256:

The recovered layers can be tracked independently:

The final PE was Amatera Stealer:

The sample fingerprinted the host, checked locale and keyboard settings, enumerated processes and adapters, captured screenshots, decrypted browser credentials, used direct Winsock communication, and supported secondary tasking. Push Security describes InstallFix as a cross-platform lure and delivery framework. Proofpoint’s Amatera analysis documents the family lineage and its C2-supplied configuration, direct socket communication, browser theft, and secondary-payload tasking. Related fake-Claude delivery was also documented by Cyderes and Straiker .

Three /cloude-91267b64-989f-49b4-89b4-984e0154d4d1 responses preserved additional obfuscated stages supporting the Windows loader chain:

A second lure exposed another Windows route

The cli-desktop[.]com page delivered the Basequill macOS route while directing Windows visitors to:

The 6,659,453-byte /fail object had SHA256 6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7 . Two public executions ran it through mshta.exe . Static Base64 and UTF-16LE decoding recovered PowerShell that disabled certificate validation and requested:

The page and decoded payload preserve another platform switch inside the same lure system: macOS received a zsh path and Windows received an mshta and PowerShell path.

Amatera presented as its TLS identity

The final PE connected directly to 77.91.65.13:443 while presenting .com through TLS SNI and HTTP authority:

The PE configured Schannel for caller-managed certificate validation through SCH_CRED_MANUAL_CRED_VALIDATION and ISC_REQ_MANUAL_CRED_VALIDATION . The binary requested stream sizes and proceeded to TLS stream construction. Its code contains no certificate-chain or hostname check.

The exact SCHANNEL_CRED values were:

0x2800 enables the TLS 1.2 and TLS 1.3 client protocol bits. The credential flags are SCH_CRED_MANUAL_CRED_VALIDATION ( 0x08 ) and SCH_CRED_NO_DEFAULT_CREDS ( 0x10 ). InitializeSecurityContextA received 0x8811c , including ISC_REQ_MANUAL_CRED_VALIDATION , stream mode, allocation, confidentiality, sequence detection, and replay detection.

The only QueryContextAttributesA request used attribute 4, SECPKG_ATTR_STREAM_SIZES , before the client exchanged application data through EncryptMessage and DecryptMessage . That implementation lets the socket connect directly to the attacker address while Schannel places .com in the ClientHello and the malware accepts the server certificate presented by the C2.

As a result, HTTPS-oriented telemetry recorded requests to .com while socket telemetry recorded the unrelated C2 address. The VirusTotal behavior record preserves both identities.

The implementation is a live malware example of the direct-to-IP identity mismatch we have researched at AdamNetworks through Underminr . Detection requires correlation among destination IP, SNI, certificate identity, DNS history, and expected service infrastructure.

Smart contracts rotated the clipper C2

AnimateClipper and ZigClipper shared a 21-address clipboard-replacement configuration and used BNB Smart Chain contracts as mutable C2 dead drops.

The contracts stored one operator-controlled C2 domain in storage slot 0. Zig used the standard ERC-20 balanceOf(address) selector as camouflage and ignored the supplied address. Animate exposed getData() directly.

From March 17 through July 26, 2026, 36 mainnet changes were preceded by the same testnet update three to four seconds earlier. Both contracts were deployed and updated by the same controller.

Cisco Talos observed Amatera delivering ZigCryptoStealer in one ClearFake branch and documented the mainnet contract’s mutable C2 value. Check Point Research recovered the Animate contract and its 21-wallet fallback configuration through a separate impersonation and traffic-distribution chain. The Triage execution of the Talos archive classified its extracted payload as AnimateClipper and recorded with lb.propertyfind.cc .

The current contract values can be reproduced with JSON-RPC:

Both calls returned lb.propertyfind.cc when observed on September 12, 2026.

The returned value used standard Solidity ABI string encoding. The contracts had already preserved a much longer history of rotating C2 names across hugo-lapp , hugo-mapp , unguidedfreewill , velqo7 , gstats-api , vogueatelier , quorashift , and propertyfind infrastructure. Those decoded values are retained in the IOC appendix below.

The recovered Animate execution showed the operational sequence behind the contract lookup:

Two independent 21-address replacement sets

The September wuess[.]com endpoint and the Animate/Zig binaries each supplied 21 cryptocurrency replacement destinations. Mechanical comparison found zero exact or case-insensitive matches between the two sets.

The contracts stored C2 domains in slot 0. The replacement addresses remained embedded in the binaries, so the setter history records C2 rotation while the binary comparison establishes the shared Animate/Zig wallet configuration.

Infrastructure reuse connected the delivery groups

The domains changed frequently, while registrar timing, nameserver groups, route tokens, certificates, and server addresses remained available for correlation.

DomiNet connected three delivery groups

Authoritative registration records showed DomiNet, IANA 3775, across 13 of 17 checked domains:

The three direct September domains were registered between September 4 and September 11. Each used a different Cloudflare nameserver pair and performed a different role:

grove-12[.]com performed the same event=pasted role in the Cato chain. The lostsh chain preserved the same xxd , AES-128-CTR, gunzip , user , BuildID , and telemetry grammar.

Hassan/Sima provisioning connected the lure themes

The hassan/sima Cloudflare pair connected Cato-confirmed bright-links[.]com with behavior-backed PasteSwitch lure infrastructure. The retained sequence ran from Bright Links on July 28 through Freshfolio, Diskclearing, Clean Disk Guide, and Homebrew-themed delivery during August.

Five domain pairs were registered 50 to 126 seconds apart across NiceNIC and Trustname:

Janet/Keaton provisioned the September lures

Four NiceNIC registrations used the janet/keaton Cloudflare pair on September 7:

The same tracked group contained hbomaxx[.]app , codex-craft[.]com , code-desktop[.]com , and claude-tools[.]com . clean-disk-tools[.]com moved from hassan/sima on August 13 to janet/keaton by September 12. Its captured Apple-styled Terminal page had SHA256 7fa9d1132f62a34aaa54fd5fa0deba45bf0258388743b69c6c74c63207e64ccb and a retained copy field containing cd temp .

Grant/Nia anchored a MacSync subgroup

The grant/nia pair connected the recovered restoremental[.]com MacSync controller with blzaeagent[.]com , helxiagent[.]com , lumenagnet[.]com , and peaecagent[.]com . The five domains appeared in retained DNS within a ten-day window. Restoremental provided the behavioral anchor through /dynamic?txd= , /pipeline/event , /gate , /tmp/osalogging.zip , API key 5190ef1733183a0dc63fb623357f56d6 , and telemetry key 5e9c0d853cfb7366d2eeec4a61ee0ed534cde9962d7f11aa4a3d2fcc104e778e .

A 61-second registration burst reused exact route tokens

Sixty-four typo-agent domains were registered through Unstoppable Domains from 2025-09-26T17:46:55Z through 17:47:56Z . The estate spanned the mcgrory/vida , nia/quincy , and grant/nia Cloudflare nameserver cohorts. Exact tokens later appeared across /curl/ delivery routes and /dynamic?txd= controller routes:

The Lalandscapelighting route returned a 1,444-byte shell stage. Two successful executions independently established Glowmedaesthetics as a MacSync controller.

The 62.60.226.69 provisioning cluster

62.60.226.69 hosted a coordinated Nova and macOS-tool neighborhood:

The six Nova names shared the address, ns3/ns4.my-ndns.com , SOA serial 2026082200 , and near-simultaneous collection timing on August 22. applediag[.]com appeared earlier that day with ns1/ns2.anycastdns.cz , a Gransy SOA, and the TXT value trustname-hosted-zone=created . The address later connected novastacktips[.]com , remotion-skills[.]com , macstoragetips[.]com , and opendisplay[.]us across the hassan/sima and janet/keaton groups.

The 176.53.159.66 delivery and teardown cluster

Thirteen domains served the same byte-identical 2,463-byte Success! page:

Five shared 176.53.159.66 and the same mismatched self-signed certificate:

The same address hosted timestamped executable delivery between July 24 and August 9:

Retained DNS placed hindustanagency[.]com on 176.53.159.66 through August 11, overlapping the teardown lifecycle.

Infrastructure assessment

PasteSwitch provisioned domains in tightly timed batches and distributed operational roles across them. DomiNet connected the direct September, Cato, and lostsh delivery groups. The Hassan/Sima and Janet/Keaton cohorts connected confirmed lures to seconds-apart sibling registrations. The typo-agent burst and exact /curl/ and /dynamic?txd= token collisions connected bulk provisioning to MacSync transaction routing.

Front-end lures, telemetry, stage delivery, tasking, exfiltration, and contract-resolved C2 rotated independently. Route grammar, API keys, campaign identifiers, process behavior, payload hashes, registrar timing, nameserver groups, origin reuse, and contract control remained available as pivots across that rotation.

Detection survives the domain rotation

PasteSwitch rotates front ends, helper hosts, telemetry endpoints, C2 servers, and exfiltration destinations independently. Process behavior, route grammar, campaign identifiers, API keys, upload formats, and contract setters remain stable across those changes.

Useful macOS process and file signals include:

Useful macOS network signals include:

Windows detections can combine mshta , the servicedae scheduled task, 32-bit PowerShell, the loader strings, and the Amatera network mismatch:

Contract monitoring can watch successful calls to setData(string) , selector 0x47064d6a , from controller 0x3a35b409af86e79e8945d6a7ffb1dc59b8dbdf46 against both contracts. Each returned string becomes a candidate C2 domain for network controls.

Default-Deny-All stops the PasteSwitch sequence

DNSharmony adds multi-provider protective DNS aggregation. If any configured resolver identifies a destination as malicious, the connection is denied. Together, dynamic allowlisting, DNS verification, and direct-IP enforcement place controls before the lure, between payload stages, and in front of C2 and exfiltration.

Indicators of compromise

The inventory below covers the directly observed routes, recovered artifacts, infrastructure, and contract state described in this article. Published MacSync and gated-ClickFix domain sets remain available through the inline Microsoft, Zscaler, RST Cloud, Cato, and lostsh references.

Additional recovered hashes

Contract-resolved C2 history

The following domains were decoded from successful setData(string) transactions against the Animate and Zig contracts. Repeated values are deduplicated.

Animate and Zig replacement addresses

Wuess replacement addresses

The HBO Max account provided PasteSwitch with a trusted advertising identity for 48 hours. The copied command exposed a delivery system that had already operated across software brands, operating systems, malware families, and infrastructure generations.

PasteSwitch kept its visible lures disposable while preserving operational structure. The same route grammar, API keys, helper identifiers, telemetry endpoints, staging conventions, task protocol, persistence paths, and registration patterns appeared after individual domains changed. On Windows, the operation combined InstallFix with layered in-memory loading and an Amatera client that presented .com over a direct socket to 77.91.65.13 . In the clipper branch, one controller synchronized C2 changes across testnet and mainnet contracts while two related binaries retained the same 21-address fallback configuration.

Those recurring controls provide the durable detection surface. Process ancestry exposes copied-command execution. Route tokens and API keys connect rotating macOS hosts. Destination, SNI, certificate, and DNS correlation expose deceptive TLS identity. Contract setter monitoring reveals new clipper C2 domains as they are published. Brand names and lure domains change; the systems behind them retain the signals needed to follow PasteSwitch.

See it on your own network

Zero Trust Connectivity reduces attack surface 7000:1 by denying egress by default. Talk to us what that looks like in your environment.