Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

PasteSwitch malicious ClickFix ads campaign via HBO Max Reddit account

Campaign
First reported
Last updated
Happening score
H score 32
1 unique sources, 1 articles

Summary

Hide ▲

The PasteSwitch campaign abused HBO Max's official Reddit account (u/hbomax) to push 108 malicious ads over 48 hours, turning a trusted brand channel into a delivery route for ClickFix attacks. The operation infected Windows and macOS users with information-stealing malware in mid-September 2026. The lure relied on a verified account to lower suspicion and widen exposure. The campaign spread theft-oriented payloads across both desktop ecosystems.

Related Happenings

Microsoft hit by network compromise

Incident
H score62 First: 02.10.2026 12:29 Last: 02.10.2026 12:29 Sources 1

About this happening: Microsoft's official X account was hijacked on Thursday, and attackers used it to post an unauthorized crypto token promotion that could mislead the account's 13 mil...

Open Happening

MacSync macOS infostealer with iCloud calendar payload delivery

Malware Activity
H score29 First: 24.09.2026 23:53 Last: 24.09.2026 23:53 Sources 1

About this happening: MacSync now uses public iCloud calendar events to deliver fresh payloads on macOS, expanding its infection chain and increasing the risk of credential theft and re...

Open Happening

ChainScript RAT delivered via ClickFix-like lures

Malware Activity
H score23 First: 21.09.2026 11:39 Last: 21.09.2026 11:39 Sources 1

How related: Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript.

About this happening: The ChainScript RAT is being delivered through ClickFix-like lures, giving operators remote access and payload deployment control on compromised Windows system...

Open Happening

PasteSwitch ClickFix malware delivery of MacSync, AMOS helper, and Amatera Stealer

Malware Activity
H score30 First: 14.09.2026 21:34 Last: 14.09.2026 21:34 Sources 1

About this happening: PasteSwitch continues to use ClickFix-style social engineering to push MacSync and related payloads onto Windows and macOS systems, with a prior HBO Max Re...

Latest development: 24.09.2026 23:53

Kaspersky identified a MacSync campaign targeting macOS that uses public iCloud calendar events to hide commands in the DESCRIPTION: line, fetch a next-stage archive from iCloud, and reach the malware through an APP bundle dropper. The same campaign also adds an Objective-C backdoor that disguises itself as Finder, establishes persistence through LaunchAgent, .zshrc modifications, and global Git hooks, and can run attacker-supplied AppleScript or replace an installed Ledger wallet app.

Open Happening

REVSTEALER game-cheat lure campaign on hijacked YouTube channels

Campaign
H score25 First: 06.09.2026 11:34 Last: 06.09.2026 11:34 Sources 1

About this happening: The REVSTEALER distribution campaign is still reaching new victims through game-cheat lures, widening exposure across at least 17 hijacked YouTube channels and two che...

Open Happening

Timeline

  1. 21.09.2026 11:39 2 articles · 13d ago

    PasteSwitch malicious ClickFix ads campaign via HBO Max Reddit account

    Initial Disclosure

    A compromised HBO Max Reddit account (u/hbomax) was first repurposed to publish malicious ads. The opening wave used ClickFix lures to push theft malware toward Windows and macOS users.

    Show sources
    Open in new tab