HBO Max Reddit account compromised to serve ClickFix attacks
Summary
A Reddit account belonging to HBO Max was compromised as part of a large-scale malvertising campaign. This attack targeted macOS and Windows users over a 48-hour period, serving malicious ads designed to initiate ClickFix attacks.
IFF Assessment
FOE
The compromise of a major company's social media account to distribute malware represents a significant threat to users and indicates a successful exploitation of trust and access.
Defender Context
This incident highlights the risks associated with compromised social media accounts being used as an initial vector for malvertising campaigns. Defenders should monitor for unusual activity on corporate social media and be aware of evolving malvertising techniques that can leverage trusted accounts.