Hackers compromised the official HBO Max account on Reddit and used it in a malvertising campaign leading to a ClickFix landing page.
During a 48-hour window, the attackers pushed 108 malicious advertisements across five lure groups as part of the campaign, tracked as PasteSwitch.
Using the verified u/hbomax account, the threat actors targeted both macOS and Windows users and aggressively promoted a native macOS application for HBO Max, which does not exist.
Clicking the malicious ads led users to hbomaxx[.]us, a page mimicking the official HBO Max site that also contained a download button.
“The download button opened a ClickFix prompt that told the visitor to copy a command, open Terminal, paste the command, and run it. This transferred execution from the browser to a trusted system utility under the victim’s control,” ADAMnetworks explains.
On macOS, the attack relied on curl | zsh commands to deliver malware such as MacSync, AMOS Helper, fake wallet applications, and other malicious code to steal users’ information, including their credentials, messages, browser information, and cryptocurrency wallet information, and gain persistent access to their machines.
On Windows, the attack relied on MSHTA and PowerShell to deliver the Amatera Stealer and achieve persistence. Configured for manual credential validation, the malware would bypass network telemetry by spoofing Facebook connections to hide its command-and-control (C&C) communication.