HBO Max Ads Compromise Expose PasteSwitch ClickFix Operation

• •108 malicious ads were published from a compromised HBO Max account over 48 hours.
• •The PasteSwitch operation targets both macOS and Windows users through deceptive tactics.
• •Joint research confirmed the operation's extensive infrastructure and its exploitation of user trust.

In September 2026, a compromised HBO Max account published 108 malicious ads over 48 hours, targeting macOS and Windows users. The ads directed users to fake software pages that executed attacker commands in the Terminal, leading to the PasteSwitch ClickFix operation. This cross-platform campaign utilized deceptive TLS tactics and contract-controlled cryptocurrency clippers. The PasteSwitch operation involved multiple components, including MacSync, AMOS, and fake wallet applications, which aimed to exfiltrate sensitive user data. The incident was confirmed through joint research by Hudson Rock and ADAMnetworks, revealing a broader malvertising blitz that exploited the trust associated with verified accounts. Administrators have paused the ads and initiated a security investigation. The attack method successfully bypassed standard browser protections by tricking users into executing malicious commands themselves.