Hackers hijack HBO Max Reddit account to push malware in ClickFix ads
-
Attackers took over the official HBO Max Reddit account and turned it into a distribution channel for malicious ads that triggered ClickFix attacks against both Windows and macOS users. The compromised account was used to run promoted posts, lending the campaign the credibility of a verified brand account while directing victims toward information-stealing malware.
ClickFix-style attacks typically rely on social engineering rather than software exploits: victims are shown fake error messages, "verification" prompts, or update dialogs that instruct them to paste a command into a terminal or run dialog, which then downloads and executes the payload. Because the user performs the final step themselves, this technique can slip past many automated defenses and browser-based protections.
Key points from the incident:
- The HBO Max Reddit account was compromised and abused to push malicious advertisements.
- The ads led to ClickFix attacks targeting Windows and macOS devices.
- The final payload was information-stealing malware designed to harvest data from infected systems.
This case highlights how much trust users place in official or verified social media accounts, and how quickly that trust can be weaponized when an account is hijacked. Promoted posts from a recognizable brand tend to receive far less scrutiny than unsolicited messages, which makes them an effective lure for delivering infostealers.
If your organization monitors social media for brand abuse, this is a reminder that account takeovers on advertising platforms can function as a malware delivery vector, not just a reputational problem. Reviewing who holds access to corporate social accounts and enabling strong authentication on those accounts remains a practical first step.
Source: BleepingComputer
Has your team reviewed access controls and MFA coverage on your organization's social media accounts recently?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login