Attackers took over HBO Max’s verified Reddit account earlier this month and used it to run 108 advertisements over roughly two days, directing people to a page that asked them to infect their own computers.
Researchers at cybercrime intelligence firm Hudson Rock set out the operation in a report on Monday. Cybersecurity firm Malwarebytes reported that Reddit paused the advertisements and opened an investigation after receiving reports. Neither the number of victims nor any losses have been established.
HBO Max’s streaming service was not breached. What was compromised was a social media account.
The Advertisement Was for Software That Does Not Exist
The clearest warning sign was in the advertisement itself, and it cost nothing to spot.
The ad promoted a native macOS application for HBO Max. There is no such application. A verified corporate account was advertising a product its own company does not make, which is the kind of check any reader can perform in the time it takes to open a search tab.
The incident came to light when a Reddit user raised it in a cybersecurity forum.
Nobody Was Hacked. They Were Asked.
There was no installer, no attachment and no software exploit. The page instructed visitors to open a terminal window, on a Mac or on Windows, and paste in a line of text.
The technique is known as ClickFix. It dresses a malicious command up as a routine step: installing an application, fixing an error, or proving you are not a bot. The victim runs the command themselves, which is precisely the point. Security software is built around the assumption that malicious code arrives uninvited. This arrives by invitation.
The hijacked account supplied the missing ingredient. An instruction like that from an unknown page is suspicious. The same instruction from a verified account belonging to a company most people have heard of is considerably less so.
Researchers named the wider operation PasteSwitch and said its delivery appeared to adapt to the visitor’s device and to whichever software was being advertised.
The Blockchain Was the Attackers’ Infrastructure
The detail most worth understanding is buried in the technical findings, and it inverts the usual story about crypto and malware.
Malware needs to reach a control server. Traditionally that address is written into the code or fetched from a domain, which is also the weak point: seize the domain, take down the server, and the infection is orphaned.
Here, researchers found the malware checking smart contracts on BNB Chain to find the current address of its control server. The attackers can update that contract when they move servers, and every infected machine picks up the new address.
The properties that make a public blockchain attractive for finance are the same ones being used here. There is no registrar to serve a takedown notice on, no host to complain to, and nothing to seize. The chain is not the target in this arrangement. It is the address book.
Researchers have seen the pattern before. Microsoft described a separate campaign using fake verification prompts where instructions were retrieved through BNB Chain, and in August researchers identified nearly 2,000 compromised WordPress sites supporting a similar operation.
What Was Being Taken
Observed Mac payloads were information stealers. Reported targets included browser credentials, saved passwords, Telegram data, Apple Notes and cryptocurrency wallet recovery phrases.
The operation was also linked to clipboard hijackers. These sit quietly and watch for a copied wallet address, then substitute one belonging to the attacker. A victim who pastes without checking sends the money to the wrong place, and the transaction is final.
The recovery phrase is the more serious of the two. A stolen password can be changed. A stolen recovery phrase hands over the wallet.
The Practical Version
Two habits cover most of this.
No legitimate software installation asks you to paste a command into a terminal. Not to fix an error, not to verify you are human, not to install an app. If a page asks, the answer is no, regardless of who appears to be asking.
And check the last few characters of a wallet address after you paste it, every time. Clipboard hijacking relies on nobody looking twice.
