Hackers hijack verified streaming account to spread malware, researchers find

Compromised verified account spreads malware

You probably know to be suspicious of a strange pop-up or a random website asking you to download something. But what happens when the ad comes from a verified account belonging to a company you recognize? That is what made a recent malware campaign involving HBO Max so concerning. Researchers at Hudson Rock found that cybercriminals hijacked HBO Max's official, verified Reddit account and used it to push 108 distinct malicious ads over roughly 48 hours.

The ads promoted HBO Max downloads along with AI tools, developer software and Mac utilities. Because they appeared under a verified corporate account, potential victims had one less reason to question what they were seeing. You do not need HBO Max to be exposed to this type of attack. The larger lesson involves how criminals can borrow credibility from verified accounts and familiar companies to get people to lower their guard. And once you click, the attack can take a surprisingly simple turn.

The mechanics of the ClickFix attack method

The incident first surfaced after a Reddit user spotted an advertisement posted by the verified u/hbomax account. The ad promoted what appeared to be a native HBO Max application for macOS. HBO Max does not currently offer a native app for Mac computers. Its support page directs Mac users to stream at HBOMax.com. The user followed the advertisement to a convincing landing page. However, clicking the download button did not start a normal file download. Instead, the website displayed a prompt telling the visitor to copy and paste a command into Terminal.

The technique behind the campaign is known as ClickFix. Rather than relying entirely on a malicious download, ClickFix gives you instructions that lead you to execute the attack yourself. The prompt may pretend that something went wrong with a CAPTCHA. Another version may claim you need to fix a browser problem or complete an installation. A malicious webpage can even place a command onto your clipboard. Then it tells you where to paste it.

Broader operation targets crypto wallets and system data

Hudson Rock and researchers from ADAMnetworks connected the HBO Max campaign to a broader operation they call PasteSwitch. The name describes what stays consistent across the operation: victims paste a command supplied by the attacker while the delivery system changes what comes next based on the visitor, platform and campaign. On Macs, researchers found several PasteSwitch payload paths. MacSync could steal browser credentials, Gecko browser profiles, Telegram data, Apple Notes and macOS passwords.

Another part of the operation used fake versions of cryptocurrency wallet apps, including Ledger, Trezor Suite and Exodus. Those fake apps were designed to steal 12- and 24-word cryptocurrency wallet recovery phrases. That means one bad command could expose far more than the browser tab you were looking at. Researchers connected PasteSwitch to another dangerous tool: cryptocurrency clipboard hijackers. The operation delivered malware known as AnimateClipper and ZigClipper, which can monitor the clipboard and replace cryptocurrency addresses when a victim copies or pastes them.

Reddit confirms breach and offers safety advice

Reddit has now confirmed that an HBO Max account authorized to run advertisements on its platform was compromised and used to distribute malicious links. In a statement provided to CyberGuy, Reddit said: “We recently learned that an HBO Max account authorized to run advertisements on Reddit was compromised and used to run ads containing malicious links. After learning of the issue, we locked the account, removed the ads and began working with HBO Max to strengthen its account security. At this time, we have not identified any impact to other Reddit advertising accounts.”

ClickFix has spread quickly because the attacker convinces the victim to take the final action. Huntress says ClickFix accounted for 53% of the malware loader activity it observed during 2025, based on its endpoint and identity telemetry. Attackers also keep changing the lure. We have already seen fake CAPTCHA prompts spread through thousands of compromised websites and bogus Windows updates use similar techniques.