Researchers reported that criminals hijacked HBO Max’s verified Reddit account and used it to run malicious ads that led people to fake download sites. The sites didn’t provide real installers, instead they tricked users into pasting and running commands in Terminal/PowerShell, causing them to infect their own device. The campaign (dubbed “PasteSwitch”) delivered information-stealing malware and crypto-focused clipboard hijackers.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you’re on Reddit, you see a legit-looking HBO Max ad offering a “native macOS app” promo download, and it’s from a verified HBO Max account. In the PasteSwitch campaign, criminals hijacked HBO Max’s verified Reddit account and pushed over a hundred ads to fake download sites. Instead of an installer, the site tells you: open Terminal or PowerShell and paste this command to install or fix the app. That’s ClickFix: the page silently copies a command, then walks you through pasting and running it so you infect yourself with infostealers like AMOS, MacSync, or Amatera, plus crypto clipboard hijackers. The only real “install” is malware. Here’s the move: if any download page or ad tells you to open Terminal, PowerShell, or Run and paste a command, stop and close it. Then go to the official site yourself if you still need the app.
Attackers took over the verified official HBO Max Reddit account and used it to run a 48-hour wave of malicious ads. The ads sent people to lookalike download sites that tricked them into copying and running commands, leading to information-stealing malware on both macOS and Windows. Researchers…
Attackers took over the verified HBO Max Reddit account and ran over 100 malicious ads that sent people to fake download pages. The pages used a ClickFix-style trick: users were told to copy/paste a command into macOS Terminal (and similar OS-targeted lures) to install information-stealing malware.
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
Scammers quickly set up fake piracy pages for Christopher Nolan’s “The Odyssey” to trick people into either clicking a fake browser “Fix It Now” warning or downloading a “movie” that is actually a Windows program. The goal is to route victims through malicious advertising redirects or get them to…
Scammers are using fake webpages that appear in search results for “TikTok” plus adult terms, promising “exclusive” explicit videos. Instead of any real content, the pages push visitors into an ad/affiliate funnel that collects emails, payment cards for fake “age verification,” or tricks people…
Attackers abused Anthropic’s Claude “Artifacts” publishing feature to host a convincing fake Claude download page on the real claude.ai domain. Victims found it via a sponsored Bing ad, clicked “Download,” and were redirected to attacker-controlled sites that delivered the SectopRAT remote access…
