Attackers hijacked the official verified HBO Max account on Reddit, u/hbomax, and used it to run 108 distinct malicious advertisements over roughly 48 hours. The ads promoted an "HBO Max for macOS" application that does not exist. Reddit administrators paused the affected ads and opened an internal investigation with their Security and Safety teams to secure the account. One of the 108 advertisements run from the hijacked account. Screenshot via Hudson Rock. Hudson Rock published the technical analysis, conducted jointly with Kirk of ADAMnetworks. Whack.sh took part in the shared investigation. How the attack works The campaign uses a technique called ClickFix. The lure page presents an installation or verification step and gives the visitor a command to copy. The visitor pastes that command into Terminal, PowerShell, or the Run box and presses enter. The command downloads and runs the payload under the visitor's own account, so the operating-system and browser warnings that gate a downloaded file never appear. Hudson Rock and ADAMnetworks named the operation PasteSwitch after the two halves of that mechanism. The victim pastes an attacker-supplied command, and the delivery system switches among platform, campaign, payload, and monetization branches based on checks that qualify the visitor. Three delivery branches macOS received Swift-based counterfeit Ledger, Trezor Suite, and Exodus applications, built to harvest 12- and 24-word BIP39 recovery phrases. Windows received a separate payload path using mshta and PowerShell. Clipboard hijacking arrived as AnimateClipper and ZigClipper, which replace a copied cryptocurrency address with an address the attacker controls. The clippers read their command-and-control location from Binance Smart Chain contracts used as mutable dead drops. Researchers recorded 36 mainnet changes from a single controller address between March and July 2026. Hosting the pointer on a public blockchain gives the operator a channel that survives ordinary takedowns, because the contract stays reachable and the destination can be rewritten at will. How to stay safe Treat any instruction to copy a command and paste it into Terminal, PowerShell, or the Run box as the attack itself. A real installer is a file you download from the vendor's own site or an official app store. Type a vendor's address yourself rather than following an advertisement. Enter a hardware-wallet recovery phrase only into the device. An application that asks for your 12 or 24 words is stealing them. A verified badge carries no guarantee. This account belonged to the brand and was under attacker control for the duration of the campaign. For teams: Name the copy-paste-into-terminal pattern directly in security awareness material. Guidance written around email attachments leaves it uncovered. Watch endpoints for a shell spawned shortly after browser activity, and for processes that write to the clipboard. Credit and sources Hudson Rock conducted this research jointly with Kirk of ADAMnetworks. Hudson Rock's report also thanks Daniel Jones of Tuxxin LLC, who took part using Whack.sh, and Emiliano of The Matrix Project. Hudson Rock report: HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation Companion report from ADAMnetworks: HBO Max ads exposed the PasteSwitch ClickFix operation Both reports carry the complete indicator list. Whack.sh opens a suspicious URL and reports what it serves, including cloaked multi-stage delivery like this one. Run a scan.