HBO Max’s verified Reddit account hijacked to spread malware

Researchers found that attackers hijacked HBO Max’s verified Reddit account to run 108 malicious ads over ~48 hours that lured users to lookalike sites and prompted them to paste-and-execute commands (ClickFix/PasteSwitch), resulting in macOS and Windows infostealers (MacSync, AMOS, Amatera) and clipboard hijackers that steal credentials and crypto data; the report describes observed payloads, infrastructure (e.g., ember-bridge.com), detection gaps, and mitigation advice.