Even HBO's Reddit Got Hacked, and Hackers Still Won't Fix Their Terrible Passwords 🎬

Hackers compromised streaming service HBO Max's verified Reddit account and used it to run 108 malicious advertisements over two days earlier this month, cybersecurity researchers said. The campaign distributed malware designed to steal passwords and cryptocurrency wallet information, according to a report published Monday by cybercrime intelligence firm Hudson Rock.

The takeover was first flagged by Alex Cutts in the r/cybersecurity subreddit, who noticed an official Reddit advertisement posted by the verified u/hbomax account aggressively promoting a native macOS application for HBO Max, a standalone application that does not currently exist. Instead of providing an installer, the linked site instructed visitors to open Terminal on a Mac, or Run or PowerShell on Windows, and paste a command that could infect their computer. The technique, known as ClickFix, disguises malicious commands as routine steps for installing software, fixing errors, or proving a visitor is human. Hudson Rock dubbed the broader operation "PasteSwitch," noting that its delivery system appears to adapt to the visitor's device and the software being advertised.

Observed Mac payloads included MacSync and Atomic macOS (AMOS), information-stealer malware designed to target browser credentials, Telegram data, Apple Notes, saved passwords, and cryptocurrency wallet recovery phrases. "These clippers utilized Binance Smart Chain (BSC) contracts as mutable C2 dead drops," researchers wrote, explaining that the malware checks Binance Smart Chain contracts for the latest address of the hackers' control server. Attackers can then update that address when they switch servers, allowing the malware to continue locating them.

Separately, nearly 2,000 hacked WordPress websites were used to distribute malware, steal data, monitor victims, and deploy ransomware, according to a report published Tuesday by cybersecurity firm Check Point Research. Researchers said the StopAndProtect ransomware family was first discovered in mid-May before being traced to a broader operation. The compromised websites hosted malware, sent commands to infected computers, and stored stolen documents, screenshots, and activity logs. The broader operation was also linked to cryptocurrency clipboard hijackers, which replace a copied wallet address with one controlled by an attacker, redirecting funds from victims who paste the substituted address without verifying it. Stolen recovery phrases pose a separate risk because they can give attackers direct control of the associated wallet.

According to cybersecurity firm Malwarebytes, Reddit administrators paused the advertisements and opened a security investigation after receiving reports of the activity. The reports did not establish how the HBO Max Reddit account was initially compromised or how many users may have interacted with the malicious advertisements before they were removed.