HBO Max's Reddit account was hijacked. How long was it compromised?

According to Hudson Rock, the verified u/hbomax Reddit account spent 48 hours pushing malicious advertisements before anyone stopped it. In that window, whoever controlled the account posted 108 distinct ads, all leading toward malware.

The account belongs to HBO Max. It carries a verification badge. That badge is the reason the campaign worked at all. A user browsing r/cybersecurity spotted one of the ads, an offer for a native macOS app for HBO Max, a product that does not exist. Clicking through led to a landing page at hbomaxx[.]us, built to look like the real HBO Max site. The download button did not download anything. It opened a prompt asking the visitor to copy a terminal command and run it. That single action, pasting and running a command, is what installs the malware. The browser never has to approve a file. The user does the work themselves.

What the account hijack did for the operation

Once inside the verified account, the attackers did not run one ad and stop. They rotated through domains, launched fresh ones when old ones got flagged, and expanded past HBO Max to lures aimed at developers and people looking for AI tools or disk cleaners. Researchers at Hudson Rock and ADAMnetworks, working with independent contributors, have named the broader operation PasteSwitch, tying it to macOS stealers, Windows loaders, deceptive TLS setups, and cryptocurrency clippers that intercept wallet addresses through smart contracts. The account compromise was not the whole operation. It was the distribution channel that let an existing malware infrastructure reach a much wider audience than a normal ad buy would.

The account's verified status is what let the campaign skip past the skepticism people usually bring to ads. Verification exists to signal that an account is who it claims to be. Here it signaled the opposite of what it was supposed to. Once the account was in someone else's hands, its history and its badge worked for the attacker, not for HBO Max.

A vigilant Reddit user is what actually ended the run, not any automated check on the platform side. The account posted 108 ads over two days before that post in r/cybersecurity surfaced the pattern.

The open question

Hudson Rock's account explains how the ads worked and what they delivered, but it does not say when the account was actually taken over, or how. It does not say whether the credentials were phished, reused from another breach, or pulled from a stolen session token. It does not say whether the 108 ads were the full extent of the compromise or just what OSINT tools could recover after the fact.

So the question the source leaves sitting there is simple: how did whoever compromised u/hbomax first get into the account?