HBO Max Reddit Account Hijacked for ClickFix Malware

Attackers used a compromised official HBO Max Reddit account, one authorized to buy ads, to push ClickFix lures that impersonate a CAPTCHA or anti-bot check, TechCrunch reported. Researchers at Hudson Rock and ADAMnetworks say hundreds of fake but real-looking ads pointed to an HBO Max-looking page that tells the victim to paste a command into Windows Command Prompt or Mac Terminal.

The payload is an info-stealer aimed at passwords, logged-in sessions, and crypto wallets. Because the user runs the terminal themselves, many of these installs slip past antivirus. Reddit confirmed the compromise of an ad-authorized HBO Max account. It has not confirmed every malware family detail in the researcher write-ups, and infection and click counts are still unknown.

Reddit told TechCrunch it locked that account and removed the ads after learning it had been used to run malicious links. Reddit would not say how many users were targeted or clicked. Warner Bros. Discovery, which owns HBO, did not comment.

Stolen sessions are also the prize in the Twitch JeetBot OAuth token leak. The HBO Max ads aimed at the same haul: passwords, logged-in sessions, and crypto wallets.

Some offers on this page may be paid placements or contain affiliate links.