# The HBO Max account ran the ads

2026-09-21

Attackers used the verified Reddit account u/hbomax to push 108 ClickFix ads in 48 hours. The blue check was the delivery network.

Canonical: https://www.fabiocti.com/notes/the-hbo-max-account-ran-the-ads/
Author: Fabio Correia

The installer did not come from a lookalike. It came from `u/hbomax`.

Hudson Rock and ADAMnetworks spent mid-September watching the official, verified HBO Max Reddit account run 108 ads in about 48 hours. They call the operation PasteSwitch. Forty-six of the ads were HBO Max itself — a Mac client the service does not ship. The rest were Codex, a disk cleaner, developer tools. Reddit paused the ads. Nobody has said how the account was taken.

macOS visitors were walked into Terminal. MacSync, Atomic Stealer, fake wallet apps for seed phrases. Windows visitors got Amatera and clippers. How many people clicked is not public. How many ran the paste is not public. The useful fact is the channel: a blue check the target already followed.

## Why the brand account is the product

You already trained people not to trust a random GitHub org named LastPass. You have not trained them to distrust the streaming company’s own Reddit. The ad unit sits on a thread they opened on purpose. The domain in the first hop can still be yours to lose; the *author* is the trust object.

This is the same class as a Claude share link and a Brevo tracker, with a different wrapper. One is a publishing feature. One is a vendor script. This one is the social account the comms team still thinks they own. Helpdesk will look for a phish. There is no phish. There is an ad from the official handle.

## What to pull if an officer “just used Reddit”

The Reddit session, not the laptop AV. New posters, new ads, OAuth apps on that account. The paste history on the Mac. Assume the wallet and the browser profile if they ran the command. Treat the brand account as a production publisher: 2FA that is not a SMS, an allowlist of who can boost, a kill switch that does not wait for legal.

A verified badge is not a code-sign. It is a password that still works.