Hackers are getting more and more sophisticated with each passing day. This time, they have compromised HBO Max’s official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. Security researchers at Hudson Rock and ADAMnetworks analysed the campaign and say the verified u/hbomax Reddit account was taken over by hackers and used to trigger 108 malicious ads over about 48 hours, which means two whole days.
The ads used a social engineering technique dubbed ClickFix which dupes users into copying and pasting malicious commands into Windows Run, PowerShell, or macOS Terminal while pretending to fix an error, verify a CAPTCHA, or install legitimate software. The type of attack has become increasingly popular among hackers because victims run the malicious commands themselves using legitimate OS tools, potentially bypassing some browser and security software designed to detect malware downloads.
Now, some of the ads pushed by the HBO Max account impersonated the streaming service, others promoted fake AI tools, macOS utilities, and developer software. Hudson Rock and ADAMnetworks have linked the attacks to a larger campaign they call PasteSwitch, which targets both Windows and macOS systems and had been used to distribute information stealers, cryptocurrency clippers, loaders, and fake crypto wallet apps.
The researchers stated that PasteSwitch refers to the operation’s use of attacker-supplied commands that victims paste into their systems, while the attackers’ backend switches between platforms, payloads, campaigns, and crypto theft methods depending on the visitor.
According to a report published by Bleeping Computer, the campaign was discovered after a Reddit user spotted an ad posted from the verified HBO Max account promoting what appeared to be a native HBO Max application for macOS. After clicking the advertisement, users were redirected to a convincing fake HBO Max website that claimed to offer the application for download.
