NewsNovo

Hackers hijack verified streaming account to spread malware, researchers find

9/23/2026

Cybercriminals hijacked HBO Max's verified Reddit account to distribute 108 distinct malicious advertisements over approximately 48 hours, according to researchers at Hudson Rock.

The ads promoted fake versions of HBO Max downloads, AI tools, and Mac utilities, leveraging the credibility of the verified corporate identity to lower user suspicion.

This campaign is part of a broader operation dubbed PasteSwitch, which uses a technique called ClickFix to trick users into executing attacker-supplied code themselves.

The attack began when a Reddit user noticed an advertisement from the verified u/hbomax account promoting a native macOS application for HBO Max.