TLDR
Hackers briefly took over HBO Maxs verified Reddit account and used it to push malware that could steal crypto wallets and browser credentials.
- The hijacked u/hbomax account ran 108 malicious ads over about 48 hours, including fake HBO Max apps and tools that installed wallet-stealing malware.
- The campaign used info-stealers, crypto address clippers, and counterfeit wallet apps, with command-and-control routed through Binance Smart Chain smart contracts.
- Crypto users should assume some Reddit ads can be hostile, avoid running copied terminal commands, and rotate credentials and wallets if they interacted with these ads.
Deep Dive
1. What Happened On Reddit
Researchers report that attackers hijacked HBO Maxs verified Reddit account u/hbomax and used it to distribute 108 malicious promoted posts over roughly two days, in what they call the PasteSwitch campaign.
According to security firms Hudson Rock and ADAMnetworks, the ads targeted both Windows and macOS users via fake HBO Max apps, AI coding tools, disk utilities, and developer tools, all leading to malware installers hosted off Reddit.
Reddit confirmed the account compromise and removed the ads, but the exact entry point, victim count, and total crypto losses have not been disclosed yet.
A blue-check or brand account on Reddit is not a guarantee of safety; attackers can temporarily control trusted handles.
2. How The Malware Targeted Crypto
Once victims followed the instructions, the payload installed information stealers, crypto clippers, and fake wallet software designed to drain funds from crypto users wallets. The campaign is described in detail in a HBO Max Reddit hack report.
On macOS, a fake HBO Max site told users to run a terminal command themselves (a ClickFix technique), while Windows variants used PowerShell or the Run dialog. Deployed malware like AnimateClipper and ZigClipper silently replaced copied crypto addresses so funds went to attacker wallets, and counterfeit wallet apps harvested seed phrases.
Researchers also found that the attackers used Binance Smart Chain smart contracts as a command-and-control layer, rotating infrastructure by changing onchain data, which made the campaign harder to shut down.
Even without exploiting your wallet directly, malware sitting on your device can silently reroute future crypto transactions.
3. How To Reduce Your Risk
If you clicked an HBO Max ad from u/hbomax leading to a download or terminal/PowerShell command, treat your device and any wallet it touched as potentially compromised.
At a minimum, consider: 1) scanning with reputable anti-malware, 2) changing passwords and enabling hardware-based 2-factor where possible, and 3) moving funds to fresh wallets created on a clean device with new seed phrases.
Going forward, avoid installing apps or running commands from ads, even from verified accounts; only download wallet software and streaming apps from official websites or app stores you navigate to yourself.
The main defense is behavioral hygiene: never run unverified commands, never enter a seed phrase into a new app because an ad told you to, and prefer hardware or well-audited wallets.
Conclusion
The HBO Max Reddit incident shows how attackers can weaponize trusted brand accounts and public blockchains to run sophisticated malware campaigns that quietly target crypto wallets. For individual users, the most effective protection is to assume that any ad, even from a familiar logo, might be hostile and to keep wallet operations strictly separated from casual browsing.
CoinsKid.Com