Hackers broke into the verified HBO Max Reddit account and used it to run 108 malicious ads over roughly 48 hours, tricking users into installing information-stealing malware on Windows and macOS. Security researchers at Hudson Rock and ADAMnetworks traced the campaign to a broader operation they call PasteSwitch — named for the tactic of supplying attacker-controlled commands that victims paste into their own terminals.
The ads used a technique called ClickFix: clicking a link appeared to begin downloading a legitimate app (an HBO Max client, a fake AI tool, a macOS disk utility), but the site then displayed instructions telling the visitor to open a Terminal or Windows Run prompt and paste in a command “to complete installation.” Those commands downloaded and ran malware without triggering standard browser download warnings, since the victim’s own operating system executed them. On macOS, the campaign delivered the MacSync infostealer — which grabs browser credentials, Firefox profiles, Telegram data, Apple Notes, and keychain passwords — and a variant called AMOS helper that digs in for persistence. On Windows, attack chains used PowerShell and a shellcode loader to inject the Amatera Stealer directly into memory, bypassing Microsoft’s Antimalware Scan Interface. The operation also pushed fake Ledger, Trezor, and Exodus cryptocurrency wallet apps designed to steal wallet recovery phrases. After the malicious ads were reported, a Reddit admin paused them and referred the incident to Reddit’s Security and Safety teams.
How to check if you’re affected
Affected devices are any Windows or macOS computer where you copied and pasted a command from a website that appeared to be offering an HBO Max app, an AI tool, or a macOS utility in the past week. If that happened, treat the device as compromised: run a full scan with an up-to-date endpoint security tool, change passwords stored in your browser, and revoke any OAuth tokens or app permissions you granted recently. Check your browser’s password manager for unknown logins — MacSync steals saved credentials, so rotate anything sensitive. If you hold cryptocurrency, move assets from any wallet whose recovery phrase was ever typed or stored on the affected device.