HBO Max Reddit Account Compromised in Major Crypto-Stealing Malware Attack

The Anatomy of the HBO Max Reddit Account Hijacking

Cybersecurity researchers from Hudson Rock and ADAMnetworks recently uncovered a high-profile security breach involving the official, verified Reddit account of streaming service HBO Max (u/hbomax). Over a 48-hour period, attackers leveraged unauthorized access to the corporate profile to deploy 108 malicious advertisements directly onto the platform. Because the account retained its official platform verification badge, the ads bypassed the immediate skepticism typically applied to sponsored content, establishing a dangerous baseline of user trust.

Rather than relying on traditional software exploits or zero-day vulnerabilities, the threat actors utilized advanced social engineering coupled with trusted brand authority. The campaign pushed users toward five distinct fraudulent landing pages mimicking artificial intelligence writing tools, developer platforms, system optimization utilities, and nonexistent native macOS desktop applications for HBO Max.

Execution via 'ClickFix' and Multi-Platform Stealers

The core mechanism behind this operation relies on an increasingly prevalent tactic known as 'ClickFix'. Instead of downloading standard executable files that trigger browser security warnings or antivirus defenses, victims were directed to lookalike sites featuring custom installation instructions.

• macOS Targeting: Users attempting to download a fake native HBO Max Mac app were instructed to open the macOS Terminal application and paste a specific command string. This command silently installed information-stealing malware capable of scraping saved browser credentials, keychain information, local Telegram databases, and Apple Notes.
• Windows Targeting: Windows users encountered equivalent prompts encouraging execution through PowerShell, Command Prompt, or the Windows Run dialog, bypassing native security guardrails by forcing the user to manually execute the payload.
• Cryptocurrency Asset Theft: Alongside general credential harvesting, sections of the campaign served malicious modifications or clone applications mimicking major cryptocurrency tools—including Ledger, Trezor, and Exodus wallet environments—specifically engineered to siphon private keys and seed phrases.

Market Implications and Corporate Security Risks

This incident exposes critical vulnerabilities in how enterprises manage their digital supply chains and social media infrastructure. For executives, entrepreneurs, and investors, the breach underscores that a company's attack surface extends far beyond cloud servers and internal databases straight into corporate social media profiles.

When a trusted brand identity is weaponized to distribute malware, the reputational damage and liability fallout can be substantial. Furthermore, the convergence of enterprise accounts with cryptocurrency asset theft highlights how threat actors continually optimize monetization channels. Digital asset holders targeted by sophisticated infostealers face immediate liquidation risks, driving regulatory and institutional scrutiny toward end-point device hygiene and credential management protocols.

What Investors and Executives Should Watch

As cybercriminals refine 'PasteSwitch' and 'ClickFix' methodologies to evade signature-based detection tools, stakeholders must monitor several critical vectors moving forward:

• Social Media Governance: Enterprises must enforce strict multi-factor authentication (MFA), hardware security keys, and granular permission boundaries for all corporate social media assets to prevent credential hijacking.
• Endpoint Execution Controls: Organizations should implement stringent endpoint monitoring that alerts or restricts users from manually executing scripts or pasted commands within administrative tools like PowerShell and Terminal.
• Brand Monitoring and Incident Response: Rapid identification and takedown protocols for compromised brand properties remain essential to mitigating large-scale distribution of malicious payloads before platform safety teams intervene.

For ongoing updates on this developing cybersecurity threat and its wider impacts across digital asset markets, reference the original reporting on Decrypt.