Overview
- Security firms Hudson Rock and ADAMnetworks say the verified u/hbomax Reddit advertising account was compromised and used to run roughly 108 malicious ads over about a 48-hour period.
- The adverts led users to fake sites that instructed them to paste commands into macOS Terminal or Windows PowerShell or Run, a ClickFix social‑engineering trick that causes victims to execute malware themselves.
- Researchers tied the ads to a modular campaign named PasteSwitch that delivered macOS and Windows payloads including MacSync, AMOS Helper, Amatera, clipboard clippers, and fake cryptocurrency wallet apps.
- Reddit paused the ads, locked the HBO Max account and opened an investigation, but security teams say the number of exposed or infected users remains unclear as analysis continues.
- The campaign used rotating domains, per‑visitor checks to foil automated scans, and smart contracts on Binance Smart Chain for resilient command routing, and defenders urge tighter ad scrutiny, Terminal/PowerShell restrictions, and endpoint script defenses.