HBO Max Reddit hack targets crypto wallets

TLDR

Hackers hijacked HBO Maxs verified Reddit account and used it to push malware that steals browser credentials and crypto wallet seed phrases.

1. The u/hbomax Reddit account was compromised and ran 108 malicious ads over about 48 hours, disguised as HBO Max and tech tools.
2. The malware stole browser logins, used address clippers to redirect crypto transactions, and deployed fake wallet apps to capture recovery phrases.
3. Crypto users should treat all Reddit ads and links as untrusted, verify official apps directly from stores or vendor sites, and never input seed phrases outside trusted wallets.

Deep Dive

1. What Happened On HBO Max Reddit

Security researchers report that attackers took over HBO Maxs verified Reddit account and used it to distribute 108 malware-laced ads over roughly two days, exploiting the trust of the verified badge.

According to one detailed writeup, the campaign (linked to the PasteSwitch operation) used themes like a fake HBO Max macOS app, AI coding tools, disk utilities, and developer tools to lure clicks from both Windows and macOS users.

A Reddit user first flagged a fake HBO Max macOS ad that sent people to a spoofed site instructing them to run terminal or PowerShell commands, effectively making victims execute the malicious code themselves.

2. How The Attack Targeted Crypto Wallets

Once installed, the malware harvested browser credentials, cookies, and other sensitive data, and included components like AnimateClipper and ZigClipper that swap copied crypto addresses to attacker-controlled ones, silently redirecting outgoing funds.

Researchers also found counterfeit wallet apps that prompted users to enter their recovery phrases; these phrases were sent to the attackers, giving them full control over victims wallets. The infrastructure used Binance Smart Chain smart contracts as a command-and-control layer, allowing attackers to rotate domains while keeping control logic on chain.

At this stage, investigators have not confirmed how many users installed the malware or how much cryptocurrency was ultimately stolen, but the tools used are capable of draining affected wallets.

3. Practical Protection For Crypto Users

1. Treat Reddit (and other social) ads as untrusted, even from verified or well-known brands; navigate to services by typing official domains or using app stores directly.
2. Never enter a wallet seed phrase or private key into a website, form, or "recovery" app; only use your wallets official interface or hardware device.
3. If you clicked suspicious HBO Max-related ads recently, run a reputable antivirus/malware scan, reset browser passwords, and consider moving funds to fresh wallets created on a clean device.

Conclusion

The HBO Max Reddit compromise shows how attackers can weaponize trusted Web2 brands and social platforms to target crypto wallets with clippers and fake wallet apps. For crypto users, strict verification of downloads, zero tolerance for entering seed phrases outside trusted wallets, and skepticism toward ads are key defenses against similar campaigns.