Summary
Hudson Rock says a compromised, verified HBO Max Reddit account distributed 108 malicious advertisements over 48 hours. The ads used ClickFix prompts to make macOS and Windows users paste commands that could deliver credential stealers, fake wallet apps and cryptocurrency clippers.
Hudson Rock says attackers used the compromised, verified Reddit account u/hbomax to publish 108 distinct malicious advertisements during a 48-hour period in September 2026. The campaign used fake software offers and ClickFix prompts to persuade users to copy and paste commands into macOS Terminal or the Windows Run dialog.
The investigation identified the activity as part of a broader operation that Hudson Rock calls PasteSwitch. Its delivery system selected different payloads for macOS and Windows, while also supporting cryptocurrency clipboard clippers and infrastructure designed to survive domain takedowns.
A verified account became the lure
The first reported advertisement promoted a supposed native HBO Max application for macOS. Hudson Rock says no such standalone application currently exists. The advertisement led to a landing page that copied HBO Max branding and presented a download button.
Instead of downloading a normal application, the page displayed a ClickFix instruction. The visitor was told to copy an attacker-provided command and execute it manually. This changes the apparent source of the action: rather than exploiting a browser download, the attack relies on the user authorising code execution themselves.
The compromised account published ads for several themes:
| Destination | Ads | Theme |
|---|---|---|
hbomaxx[.]app |
40 | Streaming and entertainment |
codex-craft[.]com |
36 | AI tools and developers |
apple.clean-disk-guide[.]com |
15 | macOS system utilities |
code-desktop[.]com |
11 | AI tools and developers |
hbomax-macos[.]com |
6 | Streaming and entertainment |
The verified corporate identity gave the advertisements an appearance of legitimacy before users reached the fraudulent pages. Reddit later paused the affected ads and began an investigation with its Security and Safety teams, according to Hudson Rock.
One pasted command, several payload paths
PasteSwitch used a shared structure for visitor qualification, staging, telemetry, payload delivery, command-and-control and data theft. The operation could switch among branches depending on the visitor's operating system and the campaign being run.
On macOS, the observed commands commonly used curl | zsh. One payload, identified as MacSync, collected browser credentials, Gecko browser profiles, Telegram data, Apple Notes and macOS passwords before packaging information for upload. Another chain, called AMOS Helper, used extended-attribute removal and executable permissions to run helpers that persisted under .com.apple.accountsd and contacted tasking endpoints.
The macOS branch also delivered fake Ledger, Trezor Suite and Exodus applications. Hudson Rock says these Swift-based applications were designed to steal 12- and 24-word BIP39 recovery phrases, which can control cryptocurrency wallets.
Windows users received a different sequence. InstallFix used mshta and PowerShell, including an MP3/HTA polyglot that created a scheduled task and disabled AMSI, a Windows security interface used by antimalware products. Later stages loaded the Amatera Stealer directly into memory.
The Amatera branch also used deceptive TLS details. It connected to the attacker-controlled IP address 77.91.65.13 while presenting facebook.com as the TLS Server Name Indication and HTTP authority. Hudson Rock says this configuration could make basic network telemetry associate the connection with Facebook rather than the actual command-and-control server.
A separate branch delivered AnimateClipper and ZigClipper, which replaced cryptocurrency addresses in the clipboard. These programs used Binance Smart Chain contracts as mutable storage for command-and-control domains. Hudson Rock observed 36 mainnet changes made by the same controller address between March and July 2026, allowing the active domain to be changed as infrastructure was taken down.
Why the operation was difficult to contain
The campaign separated visible lures from the delivery system behind them. Streaming brands, developer tools and disk-cleaning utilities could be replaced while recurring route tokens, API keys, helper identifiers, telemetry endpoints and staging conventions remained.
Hudson Rock identifies several useful detection signals: the process ancestry created by copied-command execution; recurring route and API-key patterns across macOS hosts; correlations among destination IPs, DNS, certificates and TLS identity; and monitoring of smart-contract updates that publish new clipper domains.
The central risk is therefore not limited to one fake HBO Max page or one Reddit account. A user who pastes a command from a fraudulent download, verification or CAPTCHA page can enter a delivery system capable of choosing a platform-specific payload and changing its infrastructure after discovery. The report documents the observed ads, pages, payloads and control mechanisms, but does not quantify how many users executed the commands or the resulting financial losses.