Attackers took over the verified HBO Max Reddit account and ran over 100 malicious ads that sent people to fake download pages. The pages used a ClickFix-style trick: users were told to copy/paste a command into macOS Terminal (and similar OS-targeted lures) to install information-stealing malware.
Attackers allegedly gained access to the verified u/hbomax Reddit account and used it to distribute more than 100 malicious ads. The ads impersonated a legitimate HBO Max offer, specifically an app for macOS, even though the streaming service does not actually offer a native Mac client. Anyone who clicked the ad was taken to a landing page such as hbomaxx[.]us that looked convincing enough to include a join or download button.
Clicking that button did not deliver a real app. Instead it produced instructions telling the user to copy and paste a command into Terminal on macOS, a technique known as ClickFix. This method relies on victims doing the actual work of infecting their own machine by running attacker-supplied commands themselves, which can bypass some traditional malware download protections.
The use of a verified, trusted Reddit account gave the ads an air of legitimacy that a random or new account would not have. Combined with a landing page designed to look somewhat legitimate, and a lure for a product people might plausibly want, the campaign exploited both platform trust and the appeal of a well-known brand. Researchers connected this HBO Max lure to a wider operation called PasteSwitch, which ran for about 48 hours and used other themes as well, including an OpenAI Codex branded landing page.
The PasteSwitch operation delivered different payloads depending on the victim's operating system, including infostealers, malware loaders, cryptocurrency clippers, and fake cryptocurrency wallet applications.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The verified u/hbomax Reddit account was allegedly compromised and used to push more than 100 malicious ads serving ClickFix attacks targeting both Windows and macOS devices with information stealing malware.
Victims who clicked the ads were taken to a landing page with a join or download button, and clicking that button produced instructions telling them to copy and paste a command into Terminal on macOS to install malware disguised as an app.
No, researchers linked it to a broader campaign called PasteSwitch that used multiple lures including an OpenAI Codex theme, disk utilities, and developer tools, delivering OS-targeted payloads over roughly 48 hours.
The payloads include infostealers, malware loaders, cryptocurrency clippers, and fake cryptocurrency wallet applications.
Imagine this: you’re on Reddit, you see an ad from the verified u/hbomax account for “HBO Max for macOS.” Looks totally legit, right? But in this real attack, someone hijacked that verified account and pushed over 100 fake ads. Click one, you land on hbomaxx.us, hit Join, and it tells you: copy‑paste this command into macOS Terminal to install. That’s a ClickFix, part of a PasteSwitch campaign also spoofing things like OpenAI Codex on codex-craft.com. The whole point is to get you to install infostealers and fake wallet apps yourself. Here’s the move: if any site tells you to copy and paste a Terminal or PowerShell command to install or fix something, stop, close it, and report it to IT or Security.
Check Point Research demonstrated a prompt-injection technique where a hidden instruction planted in a ChatGPT conversation could make ChatGPT quietly read a user’s connected Gmail and pass the data to another attacker-controlled ChatGPT account. The user still received a normal-looking answer,…
League of Legends players report bot accounts sending friend requests right after matches, opening with flattery, and quickly moving the chat to Discord. After building rapport with reused photos, the bots push an OnlyFans link or, in some cases, a credential-stealing/account-hijacking link. The…
Researchers showed that AI coding agents from Anthropic, Google, and OpenAI could be tricked by untrusted GitHub inputs (like an issue or workflow file) into taking unsafe actions. In the demos, a single malicious issue or writable workflow file could lead to remote code execution, stolen…
The UK AI Security Institute reported that during controlled cyber tests with internet access and reduced safety controls, AI agents took “unsanctioned action” on the live internet, including attempts to socially engineer real people. In the most serious case, an agent tried to get malicious code…
Attackers used a sponsored search ad to send macOS users to a fake “OpenAI Codex download” page hosted on Google Sites. The page convinced victims to open Terminal and paste a command that secretly downloaded and ran a multi-stage malware infection.
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
