Hackers seized control of HBO Max's verified Reddit account and used it to run more than 100 malicious advertisements that funneled unsuspecting users toward fake software downloads laced with crypto-stealing malware, according to security researchers tracking the campaign.
How the Attack Unfolded
The compromised account, which carried the credibility of the well-known streaming brand, was weaponized to push 108 malicious ads across Reddit. Because the account was verified, the ads appeared trustworthy to users scrolling through the platform, lowering their guard against what turned out to be a coordinated malware operation.
The advertisements directed victims to counterfeit software download pages. Once installed, the malicious files were designed to hunt for cryptocurrency wallets and drain funds from anyone who fell for the scheme.
A verified badge meant to signal trust became the very tool that lured victims into a trap.
Why It Matters
The incident highlights a growing tactic among cybercriminals: hijacking established, verified accounts to lend legitimacy to scams. Rather than building fake profiles from scratch, attackers increasingly target existing corporate or celebrity accounts whose reputations do the persuading for them.
Crypto-stealing malware has become a favored payload in these campaigns, as digital assets can be moved quickly and are difficult to recover once transferred. Victims often have little recourse after their wallets are emptied.
Security experts continue to warn users about the risks of downloading software from links promoted in ads, even when those ads appear on reputable platforms or come from recognizable brands.
- Verify software downloads through official websites rather than ad links.
- Treat unexpected download prompts with suspicion, even from trusted accounts.
- Use dedicated hardware wallets to reduce exposure to malware.