GoKawiilHBO Max's verified Reddit account hijacked to spread ClickFix malware
Attackers took over HBO Max's official, verified Reddit account and used it to post 108 malicious ads over roughly two days, tricking Windows and macOS users into installing information-stealing malware. The ads used the ClickFix technique, luring victims into pasting attacker-supplied commands into Run, PowerShell, or Terminal under the guise of fixing errors or verifying CAPTCHAs, with some posts impersonating a fake HBO Max app and others posing as AI tools or developer utilities.
GoKawiil's interpretation of the reporting above, not reported fact.
Researchers tie the incident to a broader operation called PasteSwitch that adapts payloads and platforms per victim, showing how attackers are industrializing social-engineering attacks that bypass traditional malware detection since victims execute the commands themselves. A trusted, verified brand account being weaponized this way also erodes user trust in official social media channels as a safe source of software links.
- HBO Max's verified Reddit account was compromised and used to post 108 malicious ads in about 48 hours.
- The ClickFix technique tricks users into manually running attacker commands, evading some security tools.
- The campaign is linked to a larger multi-platform operation called PasteSwitch distributing stealers and crypto-theft tools.
Source: bleepingcomputer.com, 2026-09-14
Published there as: “Hackers hijack HBO Max Reddit account to push malware in ClickFix ads”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.