A verified corporate account on a major social platform became a malware delivery system for two days this month, pushing more than a hundred advertisements before the platform intervened.
The account belonged to HBO Max. A visitor browsing Reddit on September 6 noticed an ad credited to the verified u/hbomax profile offering a macOS app for a service that has never shipped one. The link led to hbomaxx[.]us, a page carrying a join-and-download button.
From a download button to a pasted command
Clicking it produced instructions to paste a line into Terminal, the familiar ClickFix playbook. Researchers at Hudson Rock and ADAMnetworks traced the chain and named the operation PasteSwitch, counting 108 distinct ads across a 48-hour window. Forty-six leaned on the streaming lure, 36 spoofed OpenAI’s Codex, and the remainder posed as a disk utility and assorted developer tools.
The traffic was screened first. Browser, screen and device signals decided whether a visitor saw the lure, a blank page or a legitimate vendor site, blinding automated scanners.
On Macs, the pasted command shells out to curl and pipes the result into zsh, skipping a separate download step. Three payloads followed: MacSync, which staged browser credentials, Telegram data, Apple Notes and macOS passwords into a hidden archive; AMOS Helper, which installed itself as a background process wearing the costume of a system service; and fake Ledger, Trezor and Exodus wallets built to harvest recovery phrases.
The operation’s crypto clippers route through smart contracts on Binance Smart Chain, letting operators rotate the drop address by editing a contract instead of registering a domain. Hudson Rock counted 36 mainnet changes between March and July. Reddit paused the ads and secured the account.
