Back Tech.Yahoo

Hackers hijacked HBO Max's Reddit account to spread malware

Tech.Yahoo • September 15, 2026

Hackers broke into HBO Max's official, verified account and used it to run fake ads that installed password-stealing malware on both Mac and Windows computers, according to security researchers at Hudson Rock and ADAMnetworks .

Over 48 hours, the compromised account, u/hbomax, pushed 108 different ads across . And, because the account carries HBO Max's verified checkmark, the ads looked completely legitimate. If you clicked one of these ads and followed the instructions, your passwords, browser data, or cryptocurrency wallet could now be in the hands of the hackers

One version of the scam advertised a native HBO Max app for Mac computers, something that doesn't actually exist. Clicking through led to a lookalike site, hbomaxx[.]us, with a download button that didn't download anything. Instead, it told visitors to open their Mac's Terminal app and paste in a command to "install" the software.

On Mac computers, the pasted command installed malware called MacSync, which grabs saved passwords, browser logins, Telegram data, and Apple Notes. Some victims were also served fake versions of the Ledger, Trezor, and Exodus cryptocurrency wallet apps, built to steal the recovery phrases that protect crypto funds. Windows users were pushed toward a different malware strain, Amatera Stealer, through a similar paste-and-run setup.

The HBO Max branding was only part of the overall operation. The researchers traced 108 ads to five fake landing pages in total, including sites posing as AI writing tools, developer software, and a Mac cleanup utility, spreading the same malware to a much wider audience.

paused the malicious ads after users flagged them in the r/cybersecurity community and says its security team is investigating. HBO and parent company Warner Bros. Discovery haven't said how the account was compromised, and didn't respond to BleepingComputer's requests for .

The key takeaway is that you should never paste any command into Terminal, PowerShell, or Run just because an ad, a "verified" account, or anyone else you don't know and trust tells you to. Legitimate apps never require you to install them that way. If you've already pasted a command like this, change your passwords right away, move any cryptocurrency to a new wallet with a fresh recovery phrase, and run a full malware scan on your computer .

Techlicious and Yahoo may earn commission from links in this article.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HBO Max Account Compromise Fuels ClickFix Malware Campaign In September 2026, hackers compromised the verified HBO Max Reddit account, launching a ClickFix campaign that distributed 108 malicious ads over 48 hours. The ads targeted both macOS and Windows users, tricking them into executing commands that installed information-stealing malware. This operation, dubbed PasteSwitch, utilized social engineering tactics to bypass security measures by convincing users to paste commands into their system terminals. The malware included infostealers, loaders, and cryptocurrency clippers, affecting user credentials and sensitive data. Security researchers from Hudson Rock and ADAMnetworks confirmed the scale and sophistication of the attack, which was paused after user reports prompted an investigation. The compromised account leveraged its trusted status to maximize the impact of the malicious ads. The incident highlights the growing threat of ClickFix attacks, which have become increasingly prevalent in 2026. 45 sources 70

Extracted Entities

Hackers hijacked HBO Max's Reddit account to spread malware

The full story

Extracted Entities

Attack Types (1)

Companies (2)

CWE Weaknesses (1)

Domains (1)

Malware (2)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)