For roughly 48 hours, ads from HBO Max's verified Reddit account offered users fake AI tools, developer software and macOS utilities. There were 108 of them. The account was not running a campaign. It had been hijacked.
Researchers at Hudson Rock found the takeover and the ad run. The verification did the work that would otherwise take a convincing fake, because a blue check beside a recognisable streaming brand lowers most people's guard before they have read the ad at all. Malwarebytes documented the campaign and the payloads behind it, and researchers at ADAMnetworks have named the operation PasteSwitch.
No installer, just a command to paste
Some of the ads pointed to convincing HBO lookalike sites that claimed to offer a native HBO Max app for macOS, or a promotional download. Neither actually served an installer. Instead, visitors were told to open Terminal on a Mac, or the Run dialog or PowerShell on Windows, and paste in a command.
That is ClickFix, and it works because it does not look like an attack. The malicious instruction is dressed as a routine technical step: fixing an error, completing a CAPTCHA, verifying you are human, finishing an install. The page can quietly copy the command to the clipboard, so the victim only has to paste and press return, which makes the infection something they performed themselves. Malwarebytes notes that ClickFix has been credited with more than half of all malware loader activity in 2025.
The payload depends on who is looking
PasteSwitch infrastructure appears to tailor the next stage to the visitor's device and to the lure that brought them there. On macOS, observed payloads included the MacSync and AMOS infostealers, which go after browser credentials and profiles, Telegram data, Apple Notes, saved passwords and cryptocurrency wallet recovery phrases. Windows visitors could end up with Amatera, an infostealer that runs in memory. The operation has also been linked to cryptocurrency clipboard hijackers, which watch for a copied wallet address and substitute an attacker-controlled one before the transaction is sent.
Reddit administrators paused the ads and opened a security investigation once reports came in. Malwarebytes says it blocks ember-bridge[.]com, which it identifies as part of the PasteSwitch infrastructure.
Never paste a command a website hands you
There is no patch for this one, which is the uncomfortable part. The defences are behavioural, and they are worth stating plainly. Treat ads with suspicion regardless of who appears to be running them, because a verified account guarantees nothing about where the link goes. Download software from the vendor's own site rather than through an advertisement. Slow down when a page uses a countdown or a live user counter to hurry you along, because that pressure is part of the technique. And never run a command copied out of a web page, an email or an ad unless you understand what it does.
Apple has started closing the gap. Users on macOS Tahoe 26.4 and later may be warned when text is pasted into Terminal, though Malwarebytes cautions that the warning does not appear for everyone, so it is not something to rely on. On the corporate side, the same advice that blunts any ClickFix campaign applies: block the known infrastructure, keep web protection on, and treat clipboard-to-terminal activity on managed endpoints as worth an alert.
The shape is familiar to readers here. We covered MacSync arriving through a fake Claude Code setup guide and a single loader tying ClickFix pages to fake game downloads. What HBO Max adds is the delivery. The attackers did not need to build trust or age a lookalike domain, because they borrowed a brand's verified account and let Reddit's own ad platform handle distribution.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.