Compromised HBO Max Reddit Account Used to Spread ClickFix Malware

According to BleepingComputer, attackers compromised HBO Max's official Reddit account and used it to distribute malicious advertisements. The ads reportedly directed victims into ClickFix-style attacks — a social-engineering technique that tricks users into manually running attacker-supplied commands, typically under the guise of a "verification" or "fix" step — resulting in infostealer infections on both Windows and macOS systems.

Why It Matters

This incident highlights two recurring risks for defenders: the abuse of trusted, high-follower brand social media accounts as malware distribution channels, and the continued effectiveness of ClickFix lures, which rely on users copying and executing commands themselves rather than exploiting a technical vulnerability. Because the traffic originates from a account with an established, trusted identity (HBO Max), victims may be more likely to trust the linked content than they would a generic phishing post. The cross-platform targeting of both Windows and macOS also means organizations can't assume Mac users are out of scope for this style of attack.

What Defenders Should Watch For

• User-awareness: reinforce that no legitimate service asks users to open a terminal/Run dialog and paste in a command to "fix" a video, CAPTCHA, or verification issue — this is the core ClickFix pattern.
• Monitor for anomalous clipboard-to-shell activity, e.g., PowerShell or Terminal/osascript invocations shortly after clipboard changes, especially from browser-spawned processes.
• Hunt for outbound connections and process trees originating from browser processes that spawn command interpreters (powershell.exe, cmd.exe, Terminal, bash) with no prior legitimate history for that user.
• Review endpoint and browser telemetry for indicators of infostealer activity (credential store access, browser cookie/session theft) following ad-network or social-referral traffic.
• Corporate/brand social media account owners should audit account security (MFA, session management, connected app permissions) given that trusted brand accounts are increasingly targeted as distribution vectors.

This is a developing story based on early reporting, and technical indicators (specific malware families, IOCs, ad-network details) have not yet been fully detailed. df00tech will continue monitoring for further disclosure. Read the original report at BleepingComputer.