Executive Summary
In September 2026, threat actors identified as PasteSwitch compromised the verified HBO Max Reddit account (u/hbomax) to conduct a massive 48-hour malvertising campaign. The attackers deployed over 100 malicious advertisements across the platform, primarily targeting macOS and Windows users through social engineering lures masquerading as native streaming applications and developer tools.
The attack chain utilizes the ClickFix technique, where victims are directed to fraudulent landing pages and instructed to copy and paste malicious commands into their system Terminal or Command Prompt. The technical infrastructure of this campaign is notably resilient, employing blockchain-based command-and-control (C2) mechanisms via Binance Smart Chain (BSC) contracts to rotate domains and evade traditional blocking methods.
This incident highlights the growing trend of compromising high-trust distribution channels to bypass security scrutiny. Organizations should recognize that even verified corporate social media profiles can be leveraged to distribute malware like AnimateClipper and ZigClipper, posing significant risks to both user credentials and cryptocurrency assets.