Overview
- Security firms reported that the verified u/hbomax Reddit account was compromised and used to run 108 distinct malicious advertisements over roughly 48 hours.
- The ads redirected users to fake sites that displayed ClickFix prompts instructing victims to copy and paste commands into Terminal, PowerShell, or Run, which then executed information‑stealing payloads.
- Researchers tied the operation to a broader campaign called PasteSwitch that delivered multiple macOS and Windows families such as MacSync, AMOS, Amatera, and clipboard clippers.
- The attackers used domain rotation and stored command‑and‑control addresses in Binance Smart Chain smart contracts to make infrastructure harder to takedown and to swap payloads quickly.
- Reddit paused the affected ads and locked the account while investigators publish technical indicators; it remains unclear how many users clicked the ads or were compromised so defenders advise never to run commands from untrusted webpages or ads.