HBO Max's Reddit Account Was Hijacked to Push Malware. The Victims Installed It Themselves.

For about 48 hours this month, the official, verified HBO Max account on Reddit ran ads for an HBO Max app for Mac. There is no HBO Max app for Mac. Anyone who clicked landed on a page that looked like a download and was told to paste a single command into Terminal to install it. The command fetched a script from a server the attackers controlled and ran it. The "app" was malware, and the person who wanted to watch a show installed it with their own hands.

That technique has a name, ClickFix, and it is now one of the most common ways a computer gets infected. This post covers what happened, why the technique gets past defenses that would have caught an old-fashioned attachment, and the two changes that put a small and medium business in a position to stop it.

What happened

Researchers at Hudson Rock, working with ADAMnetworks, documented the campaign after a Reddit user spotted the fake ad on September 6 and posted it to r/cybersecurity. Reddit paused the ads a few days later and said its safety and security teams were investigating. By Hudson Rock's count the hijacked account pushed 108 distinct ads in roughly two days. Neither Reddit nor Warner Bros. Discovery has said how the account was taken over.

The ads did not all sell HBO Max. Of the 108, 36 pointed at a fake download page for OpenAI Codex, 11 at a fake developer tool, and 15 at a fake Mac disk-cleanup guide. The attackers used a trusted, verified account to advertise whatever people were likely to install without thinking, and the pages sorted visitors by operating system. Mac visitors got a stealer the researchers call MacSync, which collects browser passwords, Firefox profiles, Telegram data, Apple Notes, and macOS passwords, plus a helper that keeps the machine enrolled with the attackers' server for follow-up tasks, plus fake Ledger, Trezor, and Exodus wallet apps built to capture recovery phrases. Windows visitors got a chain that ran through mshta and PowerShell to load Amatera Stealer in memory, a stealer Proofpoint documents going after saved browser data, crypto wallet files, email clients, and messaging apps. A third branch installed clipboard hijackers that swap a pasted crypto address for the attackers' own.

Hudson Rock's Alon Gal summed it up: "The campaign proves once again why trusted distribution channels are becoming prime targets for infostealer delivery." The researchers listed more than 80 domains and 13 command servers tied to the operation, which they named PasteSwitch. No count of infected users has been published.

Why "paste this command" works

An old-fashioned attack asks you to open a file. Email filters scan the attachment, the browser warns about the download, and the security software inspects the file when it lands on disk. ClickFix skips all of that. The page tells you to copy a command, open a built-in tool your computer already trusts (Terminal on a Mac, the Run box or PowerShell on Windows), paste, and press Enter. The browser does not download a file you have to open. The command itself does the downloading, using the same system tools your IT staff use every day.

Microsoft, which tracks the technique, put the problem plainly in its own analysis: because ClickFix relies on a human to launch the command, a campaign using it "could get past conventional and automated security solutions." The lures vary. Fake CAPTCHA pages that ask you to "prove you are human" by pressing a few keys. Fake Chrome crash errors with a "fix." Fake meeting-app updates. And, as this month showed, fake apps sold through a real brand's real account.

The numbers say it is not a niche trick. ESET reports ClickFix detections grew 108 percent between the second half of 2025 and the first half of 2026, on top of a jump of more than 500 percent the year before, when it became the second most common attack vector ESET blocked, behind only phishing. Coverage of Microsoft's 2025 Digital Defense Report put ClickFix at 47 percent of the initial-access cases its Defender Experts team flagged, the most common technique on that list. The U.S. Department of Health and Human Services issued a sector alert on it back in October 2024, listing the payloads it delivers: Lumma, Vidar, DarkGate, NetSupport RAT, and more. Those are the tools that empty a browser's saved passwords and hand them to whoever pays.

What this looks like at a 10 to 500 person business

Nobody at your company is going to paste a command because a Reddit ad told them to. Except that someone will. The person who wanted the "Mac version" of a streaming app on a work laptop. The developer who saw a slick page for an AI coding tool, which is what 36 of those 108 ads were selling. The office manager who hit a CAPTCHA on a supplier's compromised website and did what it said. The technique works because the instruction arrives at the moment the person wants something, from a source that looks legitimate, and it asks for something that seems harmless: press a few keys.

What the stealer takes is the part that matters to the business. Saved browser passwords for Microsoft 365, the bank, the payroll provider, the CRM. Session cookies that let an attacker into those accounts without a password or an MFA prompt, which is the same problem we covered when stolen AI session tokens started showing up for sale. Those credentials are what infostealer markets exist to sell. The business email compromise that follows, weeks later, looks like it came from nowhere.

Two changes that put you ahead of it

Change the rule. Make it a written, repeated rule: no legitimate website, app, or support process asks you to paste a command into Terminal, the Run box, or PowerShell. If a page asks for that, close it and tell someone. SentinelOne's researchers give the same advice, and Microsoft goes further: if your users do not need the Run box, turn it off, and restrict PowerShell for accounts that have no reason to use it. Those are policy settings, not products, and they remove the button the attacker needs the user to press.

Change the layer that watches the device. The ClickFix chain is a sequence of behaviors on the endpoint: a terminal or script host spawned from a browser session, a command fetching a script from an unknown domain, a new process disabling a security feature or setting a scheduled task, a stealer reading browser credential stores. Antivirus that waits for a known-bad file has nothing to scan. Endpoint detection and response is built to watch the sequence. Our managed endpoint protection runs on SentinelOne, whose platform SentinelOne says uses static and behavioral AI engines on the device and is capable of detecting and preventing the behaviors associated with ClickFix campaigns, with what it calls autonomous, machine-speed prevention that kills and quarantines unauthorized processes in real time. Whether a given attack is caught depends on the campaign and the configuration, which is why we manage the configuration and a named engineer reviews what the platform flags rather than leaving an alert queue to nobody.

Two supporting layers round it out. ClickFix also arrives by email; the HHS alert cites Proofpoint tracking one criminal group that sent more than 100,000 emails in campaigns using the technique. Our managed email security, built on Check Point Harmony Email and Collaboration, is designed to catch the social engineering that gets a user to the page in the first place. And because a stealer's whole business is selling what it takes, our dark web monitoring add-on watches criminal markets for credentials tied to your domains, so a password can be reset while resetting it still matters.

We work with small and medium businesses nationwide from our home base in McLean, Virginia. If you want to know whether a pasted command on one of your laptops would be caught or would run to completion, book a free 15-minute call. We will walk through what an endpoint layer sees during a ClickFix chain and what your current setup would report.

Sources: Hudson Rock and ADAMnetworks research on the PasteSwitch campaign (Sept 2026), as reported by BleepingComputer, Help Net Security, and The Register; Microsoft Security Blog, "Think before you ClickFix" (Aug 21, 2025); ESET Threat Report H1 2026 and H1 2025; HHS Health Sector Cybersecurity Coordination Center sector alert on ClickFix (Oct 29, 2024); SentinelOne research (May 2025); Proofpoint analysis of Amatera Stealer (2025); SentinelOne and Check Point product materials for vendor claims.