HBO Max Account Compromise Fuels ClickFix Malware Campaign

• •108 malicious ads were published via a compromised HBO Max account in 48 hours.
• •The ClickFix technique tricks users into executing malicious commands in their terminal.
• •The PasteSwitch operation targets both macOS and Windows systems with various malware types.

In September 2026, a compromised HBO Max account was used to publish 108 malicious ads over 48 hours, targeting both macOS and Windows users. The ads employed a ClickFix technique, tricking users into pasting malicious commands into their system terminals, leading to the installation of information-stealing malware. This operation, dubbed PasteSwitch, spans various malware types including MacSync stealers and AMOS malware. The attackers utilized deceptive TLS and contract-controlled cryptocurrency clippers as part of their infrastructure. The campaign's scale and sophistication have prompted security investigations, with affected users advised to check for malware. The attack highlights the growing prevalence of ClickFix tactics in cybercrime. Administrators have paused the malicious ads and initiated security reviews.