HBO Max Reddit Account Hacked for Cryptocurrency Heist

HBO Max's official Reddit account was compromised by hackers in early March, who then used it to spread 108 malicious ads within 48 hours.

The ads lured users into downloading a fake HBO Max native macOS app, which would prompt them to open Terminal or PowerShell and paste malicious commands. This tactic is known as ClickFix.

Researchers have dubbed the attack 'PasteSwitch', with its delivery system adapting to the visitor's device and the promoted software. The observed payloads included MacSync and Atomic macOS (AMOS) info-stealing malware, targeting browser credentials, Telegram data, Apple Notes, saved passwords, and cryptocurrency wallet seed phrases.

The malicious software also utilized a Binance Smart Chain contract as a variable C2 address delivery point and was associated with an encrypted clipboard wallet hijacking program that replaced clipboard addresses. Reddit administrators suspended the ads after receiving reports and launched a security investigation.