Reddit

Cryptocurrency

Rock

<p><strong>Hackers hijacked the verified HBO Max Reddit account and used it to blast 108 fake advertisements at unsuspecting users, all designed to steal cryptocurrency wallets and browser credentials in a sophisticated cross-platform malware campaign researchers are calling PasteSwitch.</strong></p>
<p><a href="https://www.hudsonrock.com/blog/hbo-max-ads-on-a-compromised-reddit-account-exposed-a-massive-pasteswitch-clickfix-operation" rel="noopener noreferrer nofollow">Hudson Rock researchers</a> say the compromised u/hbomax account ran 108 distinct ClickFix advertisements over a 48-hour window. The account was verified, meaning Reddit users had every reason to trust what they saw.</p>
<figure style="margin:24px 0;padding:22px 24px;border:1px solid #d7dce5;border-left:5px solid #dc2626;background:#f8fafc;border-radius:8px;font-family:Arial,sans-serif;">
 <div style="font-size:12px;font-weight:700;letter-spacing:0.08em;text-transform:uppercase;color:#64748b;">
  Compromised-account campaign
 </div>
 <div style="margin:7px 0 5px;font-size:52px;line-height:1;font-weight:800;color:#111827;">
  108
 </div>
 <figcaption style="font-size:15px;line-height:1.45;color:#334155;">
  distinct ClickFix ads were reportedly run in 48 hours from the verified u/hbomax account, according to Hudson Rock.
 </figcaption>
</figure>
<h2 id="hbo-max-s-reddit-account-reportedly-used-to-spread-malware">HBO Max’s Reddit Account Reportedly Used to Spread Malware</h2>
<p>The ads sent users to convincing lookalike download pages that looked like legitimate HBO Max installers. Once there, macOS users were told to paste commands into Terminal; Windows users were directed to paste into Run or PowerShell. This is the hallmark of ClickFix, a social-engineering technique that tricks victims into executing malware themselves. For related coverage, see <a href="https://www.theccpress.com/senate-rejects-clarity-act-bitcoin-uncertainty/" rel="noopener noreferrer nofollow">Senate Rejects CLARITY Act, Raising Bitcoin Uncertainty</a>.</p>
<p><a href="https://www.malwarebytes.com/blog/news/2026/09/hbo-maxs-verified-reddit-account-hijacked-to-spread-malware" rel="noopener noreferrer nofollow">Malwarebytes reports</a> that macOS victims could receive MacSync or the Atomic macOS Stealer (AMOS), both designed to siphon browser credentials, Telegram session data, saved passwords, and cryptocurrency wallet recovery phrases. Windows users faced Amatera, an in-memory infostealer that leaves minimal forensic traces.</p>
<p>The identity of the threat actors and the exact method used to take over the HBO Max account have not been publicly confirmed. The PasteSwitch operation’s blockchain infrastructure, however, left a clearer trail. This mirrors patterns seen in <a href="https://www.theccpress.com/bnb-chain-malware-fake-captchas/" rel="noopener noreferrer nofollow">BNB Chain malware campaigns that used fake CAPTCHAs</a> to deliver similar clipboard-hijacking payloads.</p>
<h2 id="how-the-crypto-stealing-malware-threat-could-affect-users">How the Crypto-Stealing Malware Threat Could Affect Users</h2>
<p>PasteSwitch is not just a simple info-stealer campaign. Hudson Rock’s research reveals a cryptocurrency clipboard-clipping branch that used BNB Smart Chain smart contracts as mutable command-and-control dead drops. When a victim copies a wallet address to make a crypto payment, the clipper silently replaces it with an attacker-controlled address.</p>
<p>Researchers observed 36 BSC mainnet contract changes made by the same controller between March and July 2026, suggesting the operation ran for months and actively rotated its infrastructure to stay ahead of blocklists.</p>
<figure style="margin:24px 0;padding:22px 24px;border:1px solid #d7dce5;border-left:5px solid #f59e0b;background:#fffbeb;border-radius:8px;font-family:Arial,sans-serif;">
 <div style="font-size:12px;font-weight:700;letter-spacing:0.08em;text-transform:uppercase;color:#92400e;">
  PasteSwitch infrastructure
 </div>
 <div style="margin:7px 0 5px;font-size:52px;line-height:1;font-weight:800;color:#111827;">
  36
 </div>
 <figcaption style="font-size:15px;line-height:1.45;color:#334155;">
  BSC mainnet C2-contract changes were observed from one controller between March and July 2026, according to Hudson Rock.
 </figcaption>
</figure>
<p>Using smart contracts as C2 infrastructure is a calculated move. Blockchain transactions are immutable and public, but the attacker controls what wallet address is written into the contract at any given moment. Victims and defenders see the theft happen on-chain but cannot easily block a decentralized smart contract the way they would a malicious domain. This technique has also been linked to <a href="https://www.theccpress.com/coinsbuy-8-million-hack-two-blockchains/" rel="noopener noreferrer nofollow">multi-chain crypto thefts that have drained millions from exchanges</a>.</p>
<p>The total number of victims and the value of any cryptocurrency stolen through this campaign remain unconfirmed, according to reporting from Decrypt. No public statement from HBO Max or Reddit has been located.</p>
<h2 id="what-crypto-users-should-do-after-seeing-suspicious-reddit-posts">What Crypto Users Should Do After Seeing Suspicious Reddit Posts</h2>
<p>Malwarebytes says Reddit administrators paused the affected ads and opened a security investigation after reports were received. But the ads ran for 48 hours, and anyone who interacted with them during that window could be at risk.</p>
<p>If you clicked a link or downloaded a file from the u/hbomax account during the campaign period, the priority is your crypto wallets. Disconnect any connected wallets from unknown sites immediately. Move assets to a fresh wallet generated on a clean, unaffected device before doing anything else.</p>
<p>Never enter a recovery phrase or private key into any site you reached through a social media post, even one from a verified account. A checkmark means the account is authenticated, not that it is safe. Attackers specifically target high-trust accounts for this reason. Always verify promotions and app downloads through official company websites directly.</p>
<p>Report any suspicious posts to Reddit and to HBO Max through its official channels. The faster platform administrators are alerted, the sooner compromised accounts are locked down. Given that <a href="https://www.theccpress.com/liquid-hackers-return-270m-bitcoin-320m-theft/" rel="noopener noreferrer nofollow">even major exchange hacks have seen partial recoveries when response time is fast</a>, early reporting matters.</p>
<p>With clipboard-clipping malware spreading through increasingly creative social-engineering channels, the question is no longer whether trusted brand accounts will be targeted again. It is which one gets hijacked next, and how many wallets get drained before anyone notices.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px;">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p>
<p>The article <a href="https://www.theccpress.com/?p=48527" rel="noopener noreferrer nofollow">Hackers Hijack HBO Max Reddit Account to Push Crypto-Stealing Malware</a> first featured on <a href="https://theccpress.com/" rel="noopener noreferrer nofollow">theccpress.com</a>.</p>

Hackers Hijack HBO Max Reddit Account to Push Crypto-Stealing Malware

Table of Contents

Cryptocurrency Press

Other articles published on Sep 17, 2026

Join our free newsletter for daily crypto updates!