Hackers took over HBO Max’s verified Reddit account and used it to publish malicious ads that tricked people into infecting their own Windows and macOS devices. Researchers at Hudson Rock and ADAMnetworks say the attackers ran 108 ads over about 48 hours and tied the activity to the PasteSwitch operation, which used fake HBO Max and software download pages plus pasted Terminal, PowerShell, or Run commands to deliver payloads including MacSync stealers, clippers, loaders, and fake crypto wallet apps.
Why it matters: People may trust ads from a verified brand account, so this campaign raises the risk of credential theft, crypto theft, and wider account compromise. Users should avoid copy-and-paste “fix” or “verification” commands from ads or websites, and Reddit advertisers and moderators should review for account compromise and malicious campaigns.
Ionut Arghire
2026.09.15
96% relevant
This is a direct report on the same event, adding specifics on the 48-hour ad run, 108 malicious advertisements, the hbomaxx[.]us lure domain, the PasteSwitch campaign name, and the malware families delivered on macOS and Windows.
2026.09.14
99% relevant
This is the same underlying event and adds concrete reporting that the verified u/hbomax Reddit account was used to publish more than 100 malicious ads, that Reddit paused the ads and investigated, and that researchers tied the activity to the broader PasteSwitch malvertising blitz using HBO Max, OpenAI Codex, and other lures.
Lawrence Abrams
2026.09.14
100% relevant
This article establishes a distinct security incident: a hijacked verified HBO Max Reddit account was used as the delivery vehicle for a specific ClickFix malware ad campaign tied to PasteSwitch.
← Back to all stories