Hackers recently took over the verified Reddit account for u/hbomax and used it to spread malware ads, issuing 108 ClickFix-based malicious promotions in just 48 hours. The ads falsely claimed to offer an official HBO Max app for macOS and enticed users to copy commands into their Terminal applications—thereby executing harmful code. This attack didn’t exploit a software vulnerability, but leveraged human trust in a recognized Reddit identity.
How the PasteSwitch Campaign Operates
Security researchers from HudsonRock and a collaborator named Kirk (from ADAMnetworks) have traced this effort to a larger cross-platform campaign known as “PasteSwitch.” Its reach extends beyond streaming scams, encompassing ads for AI tools, developer utilities, disk-cleaning software, fake wallets, and other software lures. The infrastructure allows the attackers to swap out the branding and payloads while keeping the same delivery methods.
For macOS users, the malicious ad prompts visitors to download something that doesn’t exist natively. Once they hit “Download,” an overlay instructs them to paste a command into Terminal—this is what installs malware or other dangerous tools. On Windows, the campaign offers an alternate route called “InstallFix,” which delivers payloads via PowerShell and mshta, often after disguising elements as harmless media files. These branches can steal credentials, infiltrate Telegram data, harvest browser and OS passwords, and even sneak past security checks.
Infrastructure, Risks, and Detection
The actors behind PasteSwitch used a variety of deceptive domains themed around streaming, developer software, disk optimization tools, and more—such as hbomaxx[.]us, codex-craft[.]com, apple.clean-disk-guide[.]com, code-desktop[.]com, and hbomax-macos[.]com. Ads appeared in streaming-style placements, developer-focused channels, and system utility categories.
One particularly insidious part of the campaign involves “clipper” malware. These watch the user’s clipboard and replace any copied cryptocurrency address with one controlled by attackers. Also, attackers can rotate their command-and-control domains through smart contracts on the Binance Smart Chain—making it harder to track or shut down the infrastructure. TLS connections are deceiving too: the visible hostname may be facebook.com even though the traffic routes to attacker-controlled IPs.
Suggested indicators for detection include unusual activity in Terminal (macOS), Run dialog windows (Windows), PowerShell or mshta executions, alerts generated by pasting commands from ads, and unexpected TLS/SNI behavior. Organizations should also monitor domains and IPs used in the campaign, check whether staff clicked or visited ad links, reset compromised credentials, and examine browser telemetry for signs of credential leakage.
This incident serves as a reminder that verified accounts—even from trusted brands—can be hijacked, allowing attack campaigns to ride on reputation. Users should never execute commands suggested by ads or pop-ups; instead, always rely on official sources for software installs. For organizations and security teams, this underscores the evolving nature of malvertising campaigns: they aren’t just annoying ads anymore—they’re fully weaponized threats.
Analytical Angle:What makes this attack particularly dangerous is its use of trusted branding and social engineering rather than code exploits. The PasteSwitch campaign highlights how adversarial actors adapt, mixing cosmetic trust signals (like verified accounts) with deep infrastructure tricks (clipper malware, blockchain-based C2, TLS deception). Moving forward, detection must go beyond signature-based tools—security operations must monitor behavior (e.g. pasting commands, unusual script execution) and reputational trust anchors. Watch for similar hijacks of verified or organizational accounts, and expect malvertising to continue evolving toward more stealthy, persistent threats.
