HBO Max Reddit Account Hacked to Push Malware Ads

What happened to the HBO Max Reddit account?

The HBO Max Reddit account was compromised and used to distribute 108 malicious advertisements during a 48-hour campaign. ADAMnetworks and Hudson Rock documented the activity on September 13, 2026, identifying the account as an official, verified HBO Max Reddit account. The account’s verified status made the advertisements appear more credible than ordinary spam because viewers could reasonably associate the posts with the streaming brand.

The malicious campaign did not rely on a fake account with a similar name. Instead, attackers used the legitimate account’s advertising access to place harmful links in promoted posts. That distinction matters because verification badges and familiar brands can lower a user’s normal caution when an ad appears in a social feed.

The method used in this case is also relevant beyond Reddit. Account takeovers can turn an established company profile into a delivery channel for scams, malware, or credential theft. Readers following other cases involving compromised online accounts can see how attackers have also targeted employee account access to reach more valuable systems.

How did the malicious HBO Max ads use ClickFix?

The malicious HBO Max ads used ClickFix, a social-engineering technique that persuades users to run a command themselves. The fake HBO Max pages instructed Mac users to copy a command into Terminal and execute it, according to the ADAMnetworks and Hudson Rock investigation. The attack therefore depended on a visitor taking an action rather than exploiting a stated software flaw.

ClickFix is dangerous because the instruction can look like a routine verification, installation, or troubleshooting step. A page can claim that Terminal is needed to finish an app download or fix a setup problem, even though the command actually starts the infection chain. The safest rule is straightforward: do not paste a command into Terminal because an ad, pop-up, or unfamiliar download page instructs you to do so.

The recovered command contacted ember-bridge[.]com and piped a downloaded setup script into zsh. ADAMnetworks said the later stage decrypted content with AES-128-CTR and executed it. That technical sequence matters because the visible instruction was only the first step, while the downloaded script performed the harmful activity afterward.

What lures did the HBO Max malware campaign use?

The HBO Max malware campaign used five lure groups, including fake streaming software, AI tools, developer software, and Mac utilities. The largest group contained 40 ads for hbomaxx[.]app, followed by 36 ads for codex-craft[.]com. The remaining ads promoted apple.clean-disk-guide[.]com, code-desktop[.]com, and hbomax-macos[.]com.

The five groups total 108 ads. The campaign’s range of lures is important because a user did not need to be looking for HBO Max to encounter the malware. Fake AI and developer tools were also part of the operation, a pattern that resembles the risks covered in TechJournal’s reporting on malicious software posing as AI tools.

The practical response is to evaluate a download source rather than trusting the product name in an advertisement. A familiar brand, a utility that promises to clean a Mac, or a tool that claims to help with coding does not establish that the linked site is legitimate.

What data could the Mac malware collect?

The observed Mac payload collected browser credentials, cookies, Keychain material, Apple Notes, shell history, SSH material, wallet data, messenger data, password-manager data, and selected files. ADAMnetworks identified these collection targets after analyzing the campaign’s recovered payload. The range of targeted data means the risk extends beyond a single streaming account or browser session.

Browser credentials and cookies can expose saved logins or active sessions. Keychain material and password-manager data can be especially significant because they may contain credentials for multiple services. SSH material can affect developer or work access, while wallet data and copied cryptocurrency addresses can create financial risk for users who manage digital assets.

The campaign also delivered tools identified as MacSync, AMOS Helper, fake wallet apps, Amatera Stealer, AnimateClipper, and ZigClipper. SecurityWeek said AnimateClipper and ZigClipper replace copied cryptocurrency addresses, which can redirect a payment if a victim pastes an altered address into a transaction. SecurityWeek’s technical reporting describes the malware families and their stated functions.

Users who executed the command should assume that saved credentials and active browser sessions may be at risk. The most sensible approach is to change important passwords from a separate trusted device, review active sessions for sensitive accounts, and contact an employer’s security team if work credentials, SSH keys, or managed devices may have been involved.

What should Mac users do after interacting with an ad?

Mac users should stop using the affected device for sensitive logins if they executed a command from one of the malicious ads. The campaign was designed to collect credentials, cookies, Keychain material, and other sensitive data, so continuing to sign in on the same device can increase the consequences if the malware remains active. Do not enter banking, work, password-manager, or cryptocurrency credentials on the suspected Mac until the device has been assessed.

1. Stop running any command or installer connected to the promoted post.
2. Disconnect the suspected Mac from networks if the command was executed.
3. Change passwords from a separate trusted device, starting with email, password-manager, financial, work, and Reddit accounts.
4. Review active sessions and sign out of sessions that you do not recognize.
5. Preserve screenshots, the ad URL, and any copied command before reporting the incident.

Mac users should not treat a deleted browser tab as evidence that the risk has passed. The reported command downloaded and ran a script, which means the relevant question is whether a command was executed, not whether the fake page remains open. Users concerned about a broader exposure can also review TechJournal’s coverage of the risks created by exposed user records, where account security steps become more important after sensitive information is involved.

Stop and contact a qualified security professional, Apple support, or an employer’s IT security team if the Mac holds work data, cryptocurrency assets, SSH keys, or business credentials. A potentially infected device requires careful handling because an incomplete cleanup can leave credentials and access tokens exposed.

How did Reddit respond to the malicious ads?

Reddit paused the affected advertisements after the malicious campaign was reported. A Reddit administrator said the ads had been paused and that the report had been referred to Reddit’s Security and Safety teams, according to BleepingComputer’s report on Reddit’s response. Pausing the ads limits additional exposure through those placements, but it does not reverse actions already taken by people who clicked or executed the instructions.

The available reporting did not establish how attackers obtained the HBO Max Reddit account. SecurityWeek said it also remained unclear whether other Warner Bros. Discovery systems were affected. That unresolved point matters because the incident is confirmed as an account takeover, while the initial access method and broader organizational impact have not been publicly established in the cited reporting.

Users should avoid assuming that a promoted post is safe because it remains visible or because it comes from a verified account. Platform action can occur after exposure begins, and attackers can use legitimate account access to make a harmful message look routine.

Why does the HBO Max Reddit account hack matter?

The HBO Max Reddit account hack shows that verified social accounts can become malware distribution channels when attackers gain advertising access. The campaign combined a recognizable entertainment brand, promoted Reddit ads, fake Mac software, and ClickFix instructions. Each element reduced suspicion in a different way, while the final Terminal command gave attackers a path to deploy information-stealing malware.

The attack also demonstrates why social-engineering defenses need to focus on behavior, not only on suspicious-looking websites. A polished ad can still send users to an unsafe domain, and a Terminal instruction can still be malicious even when the page claims it will install a familiar app. The specific warning sign in this campaign was the request to copy and run a command.

For most users, the practical rule is to download software only from a vendor’s known distribution channel and to treat instructions from advertisements as untrusted. Users who see suspicious promoted posts should report them through the platform rather than testing the download. That response protects both the individual user and other people who may see the same ad.

FAQ

Was the HBO Max Reddit account really hacked?

Yes, the official verified HBO Max Reddit account was used to publish 108 malicious ads over 48 hours. The cited reporting confirmed the malicious ad activity, although the public reporting did not establish how attackers obtained access to the account.

What is ClickFix malware?

ClickFix is a social-engineering method that tricks a user into running a command or completing a harmful action. In this campaign, fake Mac pages instructed visitors to copy a command into Terminal, which then downloaded and ran a malicious script.

Did the malicious HBO Max ads target only Mac users?

No, the campaign used multiple lures, although the documented fake HBO Max pages gave Mac users Terminal instructions. The reported lure groups also included fake AI tools, developer software, and Mac utilities.

What should I do if I pasted the command into Terminal?

Users who pasted the command should stop using the Mac for sensitive logins and change important passwords from a separate trusted device. Contact a security professional, Apple support, or an employer’s IT team if the device contains work data, financial accounts, wallets, or SSH material.

Did Reddit remove the malicious HBO Max ads?

Yes, Reddit said the affected advertisements had been paused after the campaign was reported. Pausing the ads reduces further exposure, but users who already clicked an ad or ran a command should still treat the incident as a possible compromise.