Highlights:
- HBO Max’s verified Reddit account was hacked to distribute malware ads over two days.
- Users were lured into installing malicious software masquerading as legitimate apps.
- Reddit has halted the ads and is investigating the breach, while HBO remains silent on the issue.
- Security experts warn against executing commands from unverified sources.
- Affected users should change passwords and run malware scans immediately.
In an alarming incident, hackers infiltrated HBO Max’s official Reddit account, using it as a launching pad for a deceptive campaign that ran over the course of about 48 hours. During this time, the compromised account, u/hbomax, disseminated 108 misleading advertisements that appeared to come from a credible source, urging users to install malware under the guise of legitimate applications. According to security researchers from Hudson Rock and ADAMnetworks, the ads targeted both Mac and Windows users, putting sensitive information at risk.
Among the fraudulent promotions was a non-existent HBO Max app for Mac, leading users to a lookalike site, hbomaxx[.]us. Here, individuals were instructed to open their Terminal and input a command under the illusion of installing the software. This maneuver was designed to bypass conventional antivirus checks, deploying malware known as MacSync, which could harvest passwords, browser data, and other confidential information. In a parallel operation targeting Windows users, another malware strain—Amatera Stealer—was similarly disseminated.
The deception was facilitated by the account’s verified status, lending an air of legitimacy that many users unsuspectingly trusted. Consequently, victims potentially compromised their passwords, browser history, and even cryptocurrency wallet recovery phrases. Given the intricate nature of this operation, researchers identified five distinct landing pages linked to the campaign, which included phony AI writing tools and Mac maintenance utilities, ultimately broadening the malware’s reach.
Reddit’s security team intervened after users raised alerts in the r/cybersecurity community, bringing a halt to the malicious ads. However, HBO and its parent company, Warner Bros. Discovery, have not disclosed how the breach occurred, nor have they responded to requests for comments from various media outlets, including BleepingComputer.
This incident underscores the critical need for vigilance online, particularly with so many individuals relying on digital platforms for entertainment and services. Security experts stress the importance of never executing commands from unverified sources, as legitimate applications do not require installation through Terminal or similar command interfaces. Users should take immediate action if they have inadvertently followed such advice—changing passwords and performing a comprehensive malware scan on their devices are essential steps.
The unfortunate reality is that as technology evolves, so too do the tactics employed by cyber criminals. With the increasing complexity of online threats, users must remain informed and cautious to safeguard their personal information.
As a side note, the global cybersecurity market is projected to reach $345.4 billion by 2026, reflecting the growing acknowledgment of digital security threats in our interconnected world. For further details, visit Techlicious.
