SecurityHeroblog
Security Basics15views

If a 'Paste This' Box Appears Instead of an Installer, That Box Is the Scam

You clicked an ad from an official account with a verified badge, and instead of an installer, a box popped up telling you to paste a command. The hand doing the pasting is yours, but what leaves is your passwords, notes, and crypto wallet. We unpack this technique — 108 ads posted in two days — with a single school locker.

Say there’s a note stuck to your school locker. It carries the school’s stamp. “Lockers are being reassigned. To move, write your current lock combination in the box below and leave it on the door.” The stamp is real, so nothing seems off. You write the combination and stick it on. That night your locker is emptied.

Nobody broke the lock. The hand that wrote the combination was yours. And the school does not put up notes like that.

The technique in this week’s news is exactly this. The note was an ad, the stamp was a verified badge, and writing the combination on the door was pasting a command. Let’s go through it in order.

What Happens — On My Screen

FACT An ad appears on Reddit (an overseas community site). The account that posted it is the official HBO Max (a US streaming service) account. It has a verified badge, too. A verified badge is the site’s mark that “this account really is that company.” The ad tells you to download the “HBO Max app for Mac.”

FACT Clicking the ad takes you to a site dressed up to look like the real one. You press the download button. But no installer comes down. Instead, a gray instruction box appears. “Open Terminal, paste the command below, and press Enter.” Terminal is the black window on a Mac where you give the computer commands in text. Windows users get a different instruction. They’re told to paste it into the Run box (the small window where you type a program name to open it directly) or PowerShell (the blue window that plays the role of Terminal on Windows).

Think back to the locker note here. The note told you to “write the combination and stick it on.” This box tells you to “paste the command.” Both make you do it with your own hands. That is the entire technique.

Why It Works

INFERRED First, because the stamp was real. The account wasn’t fake — it was a real official account that had been hijacked. A verified badge means “this account belongs to that company,” not “the person using this account right now works for that company.” It’s the same as the stamp on the locker note being real even though someone who stole the stamp may have applied it.

INFERRED Second, because it used the mindset of someone looking for an app exactly as it was. “To install, do this” is a phrase you commonly see on install screens. So when one more step is tacked on, it’s hard to feel that anything is strange. But a normal install ends when you receive the file. Either an installer like a .dmg or .exe comes down, or you’re handed off to the app store. One or the other. It never makes you run commands.

FACT Third, because there wasn’t just one lure. Of the 108 ads posted by the same account, 46 were dressed up as the HBO Max app. The rest were AI development tools like OpenAI Codex (47) and a Mac disk cleanup app (15). For people who don’t use streaming apps, a different note was on the locker. The note’s content changed from “locker reassignment” to “lunch sign-up,” but the last line was always the same: “Write the combination and stick it on.”

FACT The ad’s address was a clue, too. It wasn’t the official address but one spelled one letter off, like hbomaxx. It’s an easy difference to miss when you click in a hurry.

What Leaves When You Paste

Let’s look at what was inside the locker. These are the things that actually get taken.

FACT On a Mac, an infostealer gets installed. An infostealer is a program that scrapes secret information stored on the computer and sends it out. Here’s the list this one (MacSync) went after. Passwords saved in the browser. Cookies (small tickets that remember your logged-in state — steal these and someone can enter your account without a password). Firefox profiles. Telegram data. Apple Notes. And the Mac’s own password. In locker terms, they took the wallet, the phone, and the diary, all of it.

FACT On Windows, a loader (InstallFix) comes in first. A loader is an errand runner that fetches the real malware behind the scenes. After that, an infostealer (Amatera) is loaded into memory. It hides and runs inside a running program without leaving a file behind. It also sets up a scheduled task so it runs again every time the computer starts. That means once it’s in, a reboot won’t get it out.

FACT People who use cryptocurrency get hit once more. Two clippers were distributed alongside. A clipper is a program that swaps the coin wallet address you copied for the attacker’s address the moment you paste it. The hand pressing the send button is yours, but the money goes somewhere else entirely. On top of that, there were fake apps imitating Ledger, Trezor Suite, and Exodus (cryptocurrency wallet programs). These fake apps go after the recovery phrase. A recovery phrase is the secret sentence that can restore a wallet in its entirety. Hand it over and the whole wallet is gone.

FACT The researchers view this activity as part of a larger operation. They bundled the fake downloads, the infostealer, the clippers, and the frequently changing command servers (the servers malware goes to for its next instructions) together and named it ‘PasteSwitch’. The HBO Max ads were merely the occasion on which that operation came to light.

The Scale in Numbers

Every number here is taken only from what is in the primary source (the Hudson Rock report). Look at the right-hand column — it explains what each number means.

Number What Put in perspective
108 Malicious ads posted by a single hijacked official account Over two days, that’s more than two new ones every hour. They didn’t appear once and vanish; they stayed in the feed continuously
About 48 hours How long the ads ran Friday evening through Sunday evening. An entire weekend was left open until someone reported it as suspicious
46 / 47 / 15 Disguised as HBO Max / as AI dev tools / as a Mac cleanup app The HBO Max disguise is less than half. The AI tool disguise is actually one ad more. You can get caught even if you don’t use streaming apps
2 Coin-address-swapping clippers distributed together Catch only one and the other remains

The table shows two things. These ads weren’t posted once by mistake; they went up steadily for two straight days. And more than half of the lures were apps unrelated to HBO Max.

FACT These 108 ads are the count of ads that appeared. How many people clicked, and how many actually pasted the command, is recorded nowhere. Impression count and victim count are different values.

It was reported that the ads started around September 6. It was reported that the first person to notice something wrong was a user of r/cybersecurity (Reddit’s security community). They reportedly found it strange in itself that an official account would post an ad for an “HBO Max app for Mac.” It was reported that Reddit, after receiving the report, took down the ads, secured the account, and is investigating. These three points are based on press reports and could not be cross-checked against official Reddit documentation.

What I Should Do Now

Back to the locker note. The school doesn’t ask you to write your lock combination and stick it up. Apps don’t ask you to paste commands either. There are two things to do.

1. If it tells you to “copy and paste a command,” close that box. Whether the pretext is installing an app, fixing an error, or an “I’m not a robot” check — it doesn’t matter. Close it, no exceptions. A normal install ends when you receive the file. The moment it makes you do the work is the signal.

2. Get apps by typing the app store or the maker’s official address directly, not through an ad link. Don’t get there by clicking an ad; type it into the address bar yourself. Even with a verified badge, the account itself may have been hijacked. The badge is not a guarantee of safety.

If you’ve already pasted it. Change the passwords saved in your browser now. If you have a cryptocurrency wallet, move it to a new wallet. This has to be done before the thief uses them first. If you realize you’ve written your locker combination and stuck it up, moving your belongings comes first — not taking down the note.

What We Don’t Know

This post was written on the basis of other people’s reporting. What we don’t yet know, we write down as not known.

  • How the HBO Max Reddit account was hijacked. Whether it was a login caught by an infostealer, password reuse, or something internal — neither the press coverage nor the primary source disclosed it. We do not assert a cause.
  • The number of people who actually pasted the command and were infected. It is recorded nowhere. 108 is the number of ads, not the number of victims.
  • Whether these ads were shown to users in Korea. Nothing has been confirmed. We do not write “it appeared in Korea too.”
  • Who is behind the attack. PasteSwitch is an operation name given by the researchers, not the name of a group. We do not speculate on nationality or affiliation.
  • The official position of HBO Max / Warner Bros. Discovery. It was reported that they did not respond to press inquiries.
  • Why Reddit’s ad review let 108 ads from a hijacked account through. This is not known.

Unconfirmed: how the account was hijacked, the number of infections, whether it was shown in Korea, who is behind the attack, HBO Max’s position, and how Reddit’s ad review handled it. The ad start date, the first discoverer, and Reddit’s response are based on press reports and could not be cross-checked against primary documents.

Sources

Primary sources listed first.

This post was written on the basis of the 2026-09-17 news brief. It is not from our honeypot observations; we took only the facts from the reports and coverage in the sources above and rewrote them in our own words. The numbers use only the values found in the Hudson Rock primary source, and content found only in press coverage is marked with “it was reported.” This post contains no IPs, credentials, malicious addresses, or commands — so that it cannot become a how-to.