aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, cybercriminals compromised HBO Max's verified Reddit account and launched 108 malicious advertisements over 48 hours, targeting both Windows and macOS users through ClickFix social engineering attacks. The campaign, linked to the broader PasteSwitch operation, tricked victims into executing malicious commands through legitimate system tools like PowerShell and Terminal, bypassing traditional security controls. The attacks distributed information stealers including MacSync and Amatera Stealer, cryptocurrency clippers, and fake wallet applications, demonstrating sophisticated multi-platform targeting capabilities. This incident represents a significant escalation in social media account takeover attacks, where threat actors exploit trusted brand verification to distribute malware at scale. The use of ClickFix techniques shows how attackers are evolving to bypass modern security tools by manipulating users into executing malicious code through legitimate operating system functions.

Why This Matters Now

This attack highlights the growing trend of verified social media account compromises being weaponized for large-scale malware distribution, requiring organizations to reassess their digital brand protection and third-party platform security strategies.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The exact method of compromise remains unclear, but attackers gained control of the verified u/hbomax Reddit account and used it to post 108 malicious advertisements over approximately 48 hours.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely reduce the blast radius of this Reddit-based social engineering campaign by constraining lateral movement and limiting exfiltration paths from compromised endpoints within cloud workloads.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Cloud workloads accessing the compromised Reddit content would likely have reduced exposure through identity-aware access controls and segmented application boundaries that limit user privilege scope within cloud environments.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Workload isolation policies would likely limit the scope of privilege escalation by constraining compromised endpoints to their designated network segments and reducing access to sensitive cloud resources.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely prevent any attempted lateral movement between cloud workloads by enforcing strict inter-service communication policies and blocking unauthorized network traversal from compromised endpoints.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized visibility controls would likely detect and constrain anomalous outbound communications to ember-bridge[.]com and other C2 infrastructure by identifying unauthorized network flows across multicloud environments.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress controls would likely constrain data exfiltration by blocking unauthorized outbound transfers and limiting the volume of sensitive data that could be transmitted from compromised cloud workloads to external servers.

Impact (Mitigations)

Despite Zero Trust controls reducing the attack surface, compromised endpoints could still execute clipboard manipulation attacks against local cryptocurrency applications, though the blast radius would be limited to isolated workload boundaries.

Impact at a Glance

Affected Business Functions

  • Brand reputation management
  • Social media marketing operations
  • Customer engagement platforms
  • Digital advertising campaigns
Operational Disruption

Estimated downtime: 2 days

Financial Impact

Estimated loss: N/A

Data Exposure

Potential exposure of Reddit account credentials for HBO Max official account. Users who interacted with malicious advertisements may have had browser credentials, cryptocurrency wallet data, Apple Notes, macOS passwords, Firefox profiles, and Telegram data compromised by MacSync and AMOS helper malware families.

Recommended Actions

  • • Implement egress security and policy enforcement to block unauthorized outbound connections to attacker infrastructure like ember-bridge[.]com and prevent data exfiltration
  • • Deploy inline IPS with Suricata signatures to detect and block known ClickFix attack patterns and malicious payload delivery attempts
  • • Enable multicloud visibility and control to detect anomalous command execution patterns and suspicious automation behaviors across endpoints
  • • Implement zero trust segmentation with least privilege policies to limit the impact of compromised user accounts and prevent credential abuse
  • • Deploy cloud firewall with URL filtering and AI-powered traffic discovery to block access to malicious domains used in social engineering campaigns

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image