Reddit locks compromised HBO Max advertising account used for malicious links

Reddit has confirmed that an HBO Max account authorised to advertise on its platform was compromised and used to distribute advertisements containing malicious links. The company told TechCrunch that it locked the affected account and removed the advertisements. The episode placed malicious content behind a trusted corporate advertising identity.

The response addressed the known account and advertising activity, but public evidence does not establish the downstream toll. Reddit did not disclose how many people saw or clicked the advertisements, and no authoritative source reviewed has confirmed successful endpoint infections or data exfiltration among those exposed.

Community report prompted Reddit investigation

The incident first surfaced publicly on 6 September, when a Reddit user reported an advertisement associated with the u/hbomax account. The advertisement promoted what appeared to be an HBO Max application for macOS and directed visitors to a page presenting a command-paste prompt.

The reporting user said the fake download page used a ClickFix-style instruction and delivered malware with account-compromise capabilities when examined in a sandbox. That technical finding remains attributed to the initial reporter and was not independently confirmed by Reddit.

On 8 September, a Reddit administrator said the affected advertisements had been paused while the platform’s Security and Safety teams investigated. Reddit subsequently told TechCrunch that the account had been locked and the advertisements removed. TechCrunch published that confirmation on 14 September, the same day Hudson Rock and ADAMnetworks released their analysis of the activity.

Warner Bros. Discovery did not respond to TechCrunch’s request for comment before publication. Available reporting therefore does not establish who managed the affected account’s credentials or whether an authorised third party was involved in its operation.

Trusted advertising identity carried the lure

The malicious links appeared through an account already authorised to advertise under the HBO Max name. This gave the advertisements the context of an established entertainment service, although Reddit’s statement did not specify the account’s ownership or management arrangements.

The macOS lure did not depend on a flaw in HBO Max, Reddit or Apple’s operating system. Instead, the landing page attempted to persuade visitors to paste and execute attacker-supplied instructions in a native operating-system shell. Researchers then observed platform-specific malware delivery following that user action. No CVE, affected software version or product vulnerability has been identified.

Some Reddit users reported reaching a legitimate HBO Max page or seeing no malicious prompt, while others encountered the ClickFix lure. Hudson Rock and ADAMnetworks proposed conditional visitor qualification as one possible explanation for the different results, but Reddit has not confirmed that delivery mechanism.

Researchers attribute 108 advertisements to the account

Hudson Rock and ADAMnetworks reported that the compromised u/hbomax account published 108 distinct advertisements over 48 hours. Their analysis described five lure destinations and themes spanning entertainment, artificial intelligence tools, developer content and macOS utilities. Reddit has not validated the count or published corresponding impression, click or geographic data.

The researchers said they captured campaign pages, payloads and archived advertising activity. They grouped the HBO Max lure into a broader cross-platform operation that they named PasteSwitch, describing macOS branches involving stealers and fake-wallet applications alongside Windows activity involving loaders, stealers and cryptocurrency clippers.

Those payload classifications and links between the activities are researcher findings, not platform-confirmed facts. PasteSwitch is an operation label rather than the name of an identified criminal or state-sponsored group. No public source has identified the responsible threat actor or established that all the malware and infrastructure described by the researchers was controlled by one entity.

Downstream impact remains unverified

The available evidence confirms live malicious delivery through a compromised advertising account. It does not confirm exploitation of a software vulnerability or establish that any quantified number of end-user devices was compromised.

Major questions remain about both the account takeover and the advertisements’ reach. No public source has disclosed the initial-access method, the campaign’s precise start and end times, or how widely the advertisements were distributed. The numbers of users who followed the links, executed the supplied instructions or developed infections are also unknown.

There is likewise no public accounting of stolen credentials, compromised account sessions, cryptocurrency assets or other downstream data access. The confirmed unauthorised access concerns the advertising account itself, so the evidence does not support describing the incident as a broader HBO Max, Warner Bros. Discovery or Reddit data breach.

No Reddit or HBO Max service outage was reported, and no public finding shows that systems beyond the advertising account were affected. It also remains unclear whether any campaign domains or payload-delivery infrastructure remained active at the evidence cutoff.

No software patch applies

There is no software update or fixed version for users to install because no product defect was identified. Reddit’s response instead focused on account and advertising controls: pausing or removing the advertisements and locking the compromised account.

Users should reject instructions from advertisements, download pages, CAPTCHA pages or unsolicited support prompts that ask them to paste commands into Windows or macOS shells. Security teams can monitor browser-to-shell execution patterns and assess the network and file indicators published by Hudson Rock and ADAMnetworks before adding them to defensive controls.

No authoritative source reviewed has identified Australian targeting, victims or operational impact. The advertisements appeared on a major platform and included lures for common desktop environments, but their geographic distribution remains undisclosed.

A familiar advertiser identity can lend credibility to a link, but the destination still warrants independent scrutiny. The Hack Academy’s online cybersecurity training programme offers a self-paced next step into cybersecurity fundamentals, with practical exercises alongside theory.

Photo Credit: DepositPhotos.com