Loading story…
Attackers compromised the verified Reddit account u/hbomax and used it to run 108 malicious advertisements over roughly 48 hours. The ads impersonated HBO Max, AI-development tools, and macOS utilities, directing targets into a ClickFix campaign researchers call PasteSwitch that persuaded victims to copy and execute commands in a terminal or Windows Run dialog.
The copied commands selected payloads by operating system: macOS victims received MacSync and AMOS Helper stealers, while a Windows InstallFix chain loaded Amatera Stealer in memory. The campaign also deployed fake cryptocurrency wallets and crypto clippers, using direct-to-IP TLS communications and Binance Smart Chain smart contracts to rotate clipper command-and-control domains. Reddit paused the malicious ads and began an internal investigation to secure the compromised account.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The controller address 0x3a35b409af86e79e8945d6a7ffb1dc59b8dbdf46 made 36 Binance Smart Chain mainnet C2-state changes between March and July 2026, rotating domains used by AnimateClipper and ZigClipper.
Reddit administrators reportedly paused the malicious advertisements associated with the compromised verified account and initiated an internal investigation involving its Security and Safety teams.
Hudson Rock and ADAMnetworks detailed PasteSwitch's macOS, Windows, and cryptocurrency-clipper delivery chains, including MacSync, AMOS Helper, InstallFix, Amatera Stealer, AnimateClipper, and ZigClipper. The report identified direct-to-IP C2, deceptive TLS signaling, victim-specific staging, malicious domains, IP infrastructure, and Binance Smart Chain contract-based clipper C2 indicators.
Attackers abused the verified u/hbomax Reddit account to publish 108 malicious advertisements over approximately 48 hours. The ClickFix lures impersonated HBO Max and software tools to deliver macOS stealers, Windows InstallFix/Amatera chains, fraudulent cryptocurrency wallets, and cryptocurrency clippers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 232 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
techcrunch.com
Open sourcemalware.news
Open sourcehudsonrock.com
Open sourceadamnet.works
Open sourcehudsonrock.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are increasingly compromising macOS systems through **ClickFix** and related social-engineering lures that trick users into pasting malicious commands into Terminal, often behind fake Cloudflare checks, bogus troubleshooting steps, fraudulent support messages, or compromised websites. A large campaign tied to hundreds of hacked WordPress sites served platform-specific payloads and used the **Polygon** blockchain to hide command-and-control locations, while the macOS payload ran largely in memory, harvested Keychain data, browser information, SSH keys, screenshots, and other files, then staged stolen data in `/tmp/osalogging.zip` before exfiltrating it. Researchers said the technique does not rely on a macOS software flaw, but on convincing victims to execute attacker-supplied commands themselves. Threat reporting indicates the tactic has become a dominant initial-access method against Mac users, especially cryptocurrency holders and developers, and that recent Apple paste warnings in Terminal have already been bypassed through Script Editor abuse. Separate intrusion research linked cryptocurrency-focused activity to malware families including **DEEPBREATH**, **SUGARLOADER**, and **CHROMEPUSH**, showing how post-compromise tooling on macOS can escalate from social engineering to broad credential and data theft by targeting `TCC.db`, Keychain contents, Chromium-based browsers, Telegram data, and Apple Notes. Security teams are being urged to prioritize behavioral detection, cross-platform response, and user controls that prevent unverified command execution on Macs.
Jul 16, 2026
Security researchers reported an active macOS social-engineering campaign that abuses **Google Search sponsored results** and Google-hosted content (notably `docs.google.com`, and also `business.google.com`) to funnel users to **forged Apple Support-like pages** and other lookalike content (including Medium posts). The pages instruct victims—often searching for “mac cleaner” tools or macOS maintenance tasks like clearing cache—to copy/paste an **obfuscated Base64** command into **Terminal**, which then downloads and executes a follow-on script with the user’s permissions. Once executed, the payload can enable remote access and data theft, including harvesting sensitive files and **SSH keys**, and may also deploy additional malware or cryptomining. One report ties the activity to delivery of the **AMOS (aka SOMA) stealer**, which was observed creating artifacts such as `.agent` (AppleScript used to run theft), `.mainHelper` (Mach-O binary), and `.pass` (password stored in plaintext), and attempting to access user data including **Documents** and **Notes**. Researchers also noted the apparent use of **compromised, Google-verified advertiser accounts** to place the malicious ads, helping the campaign bypass ad-platform trust checks.
Jun 29, 2026
Researchers reported multiple social-engineering campaigns targeting macOS users with **fake CAPTCHA** and **ClickFix** lures that trick victims into copying and pasting malicious commands into Terminal, shifting execution to the user and bypassing traditional app-download protections. One campaign delivered **Atomic macOS Stealer (AMOS)** through trojanized cracked applications and malicious Terminal instructions, stealing credentials, browser data, cryptocurrency wallets, Telegram data, VPN profiles, keychain contents, Apple Notes, and files from common user folders before compressing and exfiltrating them over HTTP/HTTPS. Trend Micro separately documented multistage fake CAPTCHA attacks that also led to infostealers and remote-access trojans, underscoring the broader use of human-verification themes to launch malware chains. A separate July 2026 macOS campaign used a fake **TrustKey** verification page on Cloudflare Pages, a Cloudflare Worker, and an AppleScript-based loader to install a persistent backdoor named **`bmodule`** via LaunchAgent persistence. The malware dynamically resolved live command-and-control infrastructure from a **Polygon** smart contract using an **EtherHiding** technique, then fingerprinted hosts, phished macOS login passwords, and fetched tasks to deploy AMOS variants, an interactive shell, or an **XMRig** cryptominer. Apple said **macOS Sequoia** has updated runtime protections, while incident reporting shows Terminal-based social-engineering chains remain effective because they rely on users to execute the malicious commands directly.
Aug 28, 2026