Cybercriminals seized control of HBO Max's official Reddit account to distribute ClickFix malware during a two-day malvertising blitz targeting Windows and macOS users. The attack unfolded on September 14, 2026, when the compromised account began posting deceptive links disguised as streaming updates. Security researchers identified the activity as part of a broader effort to infect systems with information-stealing malware through fake software updates.
The hackers used the trusted HBO Max profile to share malicious links that redirected users to fraudulent websites. These sites mimicked legitimate software update pages, tricking visitors into downloading ClickFix, a malware variant designed to harvest login credentials and financial data. The campaign specifically targeted both Windows and macOS environments, exploiting cross-platform vulnerabilities in browser extensions and download managers. Investigators noted the attack's timing coincided with peak evening traffic on Reddit, maximizing potential exposure.
Security analysts observed that the malicious links employed URL shorteners and encrypted payloads to bypass standard security filters. Once clicked, the malware deployed in stages, first checking the victim's system configuration before installing persistence mechanisms. The attack avoided triggering antivirus alerts by using code signing certificates stolen from legitimate developers. Researchers emphasized that the campaign's sophistication suggested involvement from an organized cybercrime group rather than isolated actors.
The HBO Max Reddit account held significant credibility due to its verified status and history of sharing official streaming updates. This trust factor made users more likely to engage with posted links without scrutiny. Cybersecurity experts pointed out that social media accounts of major brands are increasingly targeted because they offer immediate access to large, engaged audiences. The breach highlighted vulnerabilities in account security protocols, particularly around multi-factor authentication and third-party app permissions.
How did attackers gain access to the HBO Max Reddit account? Investigators believe the breach occurred through compromised credentials or a phishing attack targeting the account's administrators, though HBO Max has not disclosed the exact method.
Can ClickFix malware be removed from infected systems? Yes, security firms have released detection signatures and removal tools for ClickFix, though complete eradication may require professional assistance if the malware has established deep system persistence.
What steps should users take if they interacted with the suspicious links? Users should immediately run antivirus scans, change passwords for sensitive accounts, and monitor financial statements for unauthorized activity, while reporting the incident to relevant cybersecurity authorities.