Back Securityweek

Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack

Securityweek • September 15, 2026

Hackers compromised the official HBO Max account on and used it in a malvertising campaign leading to a ClickFix landing page.

Using the verified u/hbomax account, the threat actors targeted both macOS and Windows users and aggressively a native macOS application for HBO Max, which does not exist.

Clicking the malicious ads led users to hbomaxx[.]us, a page mimicking the official HBO Max site that also contained a download button.

“The download button opened a ClickFix prompt that told the visitor to copy a command, open Terminal, paste the command, and run it. This transferred execution from the browser to a trusted system utility under the victim’s control,” ADAMnetworks explains.

On macOS, the attack relied on curl | zsh commands to deliver malware such as MacSync , AMOS Helper, fake wallet applications, and other malicious code to steal users’ information, including their credentials, messages, browser information, and cryptocurrency wallet information, and gain persistent access to their machines.

On Windows, the attack relied on MSHTA and PowerShell to deliver the Amatera Stealer and achieve persistence. Configured for manual credential validation, the malware would bypass network telemetry by spoofing connections to hide its command-and-control (C&C) communication.

The PasteSwitch campaign also used AnimateClipper and ZigClipper as persistent clipboard replacement tools to swap cryptocurrency addresses when users attempted to make a transaction, HudsonRock notes.

According to the security firms, the clipboard stealers use a C&C hosted on the blockchain. The infrastructure was likely set up over a year ago and has been used in attacks since early 2026.

was notified of the malicious activity associated with the official HBO Max account and immediately suspended the ads.

SecurityWeek has emailed Warner Bros., which owns HBO Max, for a statement on the hack and will update this article if the company responds.

Related: Personal, Financial Info Exposed in Revolut Data Breach

Related: Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution

Related: Telus Warns Customers of Account Breaches

Related: ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HBO Max Account Compromise Fuels ClickFix Malware Campaign In September 2026, hackers compromised the verified HBO Max Reddit account, launching a ClickFix campaign that distributed 108 malicious ads over 48 hours. The ads targeted both macOS and Windows users, tricking them into executing commands that installed information-stealing malware. This operation, dubbed PasteSwitch, utilized social engineering tactics to bypass security measures by convincing users to paste commands into their system terminals. The malware included infostealers, loaders, and cryptocurrency clippers, affecting user credentials and sensitive data. Security researchers from Hudson Rock and ADAMnetworks confirmed the scale and sophistication of the attack, which was paused after user reports prompted an investigation. The compromised account leveraged its trusted status to maximize the impact of the malicious ads. The incident highlights the growing threat of ClickFix attacks, which have become increasingly prevalent in 2026. 45 sources 70

Extracted Entities

Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack

The full story

Extracted Entities

Attack Types (1)

Domains (1)

Malware (6)

MITRE ATT&CK (3)

Platforms (2)

Tools (4)