🎬 A blue-check account, a fake app, 108 malicious ads

HBO Max has no standalone macOS app — and that gap is exactly what the attackers sold. They seized the verified u/hbomax Reddit account and ran 108 ads over ~48 hours, each offering an "official" desktop client that doesn't exist.

🔸 Mac victims got AMOS or MacSync — stealers targeting passwords, Telegram data, and wallet seed phrases
🔸 Clipboard hijackers swapped copied wallet addresses for attacker-controlled ones
🔸 C2 servers hid behind BSC smart contracts, letting hackers rotate infrastructure on the fly

Reddit paused the ads after the campaign was flagged; victim counts remain unknown, per Malwarebytes. The streaming service itself wasn't breached — just its account. The verified checkmark did the rest.

Decrypt