Skip to content
INFOSTEALERS By HudsonRock
ClickFix

HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation

InfoStealers
18 min read
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation

HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation

In September 2026, the cybersecurity community uncovered a massive, highly coordinated malvertising campaign leveraging the official, verified HBO Max Reddit account (u/hbomax). Over a frantic 48-hour period, the compromised account pushed 108 distinct “ClickFix” advertisements to users across the platform.

Through joint research conducted by Hudson Rock and Kirk from ADAMnetworks (with additional thanks to Tuxxin from Whack.sh and Emiliano from The Matrix Project), we can confirm this incident is part of a massive, cross-platform delivery operation we are dubbing PasteSwitch. This operation spans macOS stealers, Windows loaders, deceptive TLS tactics, and contract-controlled cryptocurrency clippers.

Initial Discovery

The incident was brought to light by a vigilant user in the r/cybersecurity subreddit. While browsing the platform, they encountered an official Reddit advertisement authored by the verified u/hbomax account. The ad aggressively promoted a native macOS application for HBO Max, a standalone application that does not currently exist.

Intrigued, the user followed the advertisement to a highly convincing landing page. Upon clicking the download button, the site did not initiate a standard file transfer. Instead, it triggered a classic “ClickFix” social engineering prompt, instructing the visitor to copy and paste a terminal command to install the software.

Initial Reddit report of the malvertising
The initial report on r/cybersecurity detailing the suspicious official u/hbomax advertisement.

The Lure: Exploiting Trust and ClickFix Mechanics

The threat actors utilized highly polished assets to establish trust before delivering the malicious payload. By hijacking a verified corporate account, they bypassed the initial skepticism many users apply to internet advertisements.

Screenshot of the malicious Reddit ad
A screenshot of the fraudulent advertisement natively displayed on Reddit, posted by the verified HBO Max account.
Fake HBO Max landing page at hbomaxx.us
The fraudulent landing page hosted at hbomaxx[.]us, designed to perfectly mimic the official HBO Max branding.
ClickFix terminal prompt
The ClickFix prompt shown by the HBO Max lure, instructing users to run malicious code in their Terminal.

Once the victim engaged with the download button, the site deployed the PasteSwitch ClickFix overlay. This tactic relies entirely on tricking the user into executing code themselves via the terminal or run dialog, successfully bypassing many standard browser-based download protections.

A Broader 48-Hour Malvertising Blitz

Further investigation utilizing OSINT tools revealed that the u/hbomax hijacking was not an isolated test run, but a massive 48-hour malvertising blitz. The threat actors squeezed as much value as possible out of the verified account’s status, pivoting quickly when domains were burned.

In total, the attackers pushed 108 distinct ads spanning multiple software lures. Beyond HBO Max, they targeted developers and power users seeking AI tools and disk cleaners.

Archived activity from the compromised HBO Max Reddit account
The archived account activity using PullPush to count the 108 advertisements pushed by the hijacked u/hbomax account.
Lure Destination Ad Volume Target Theme
hbomaxx[.]app 40 ads Streaming / Entertainment
codex-craft[.]com 36 ads AI Tools / Developers
apple.clean-disk-guide[.]com 15 ads macOS System Utilities
code-desktop[.]com 11 ads AI Tools / Developers
hbomax-macos[.]com 6 ads Streaming / Entertainment

Unveiling PasteSwitch: Cross-Platform Delivery

The HBO Max ads provided one entry into a larger delivery system. Recovered pages and payloads showed separate services for lures, visitor qualification, staging, telemetry, payload delivery, C2, and exfiltration. The name PasteSwitch describes the stable action at the center of each route: the victim pastes an attacker-supplied command, and the delivery system dynamically switches among platform, campaign, payload, and monetization branches based on visitor qualification checks.

The macOS Branch: MacSync, AMOS, and Fake Wallets

On macOS, PasteSwitch relies heavily on curl | zsh commands. The payloads included:

  • MacSync: Used transaction tokens (/dynamic?txd=) and chunked uploads to exfiltrate browser credentials, Gecko profiles, Telegram data, Apple Notes, and macOS passwords via a /tmp/osalogging.zip stage. The same execution pattern appeared in campaigns previously documented by Zscaler, Microsoft, and RST Cloud.
  • AMOS Helper: An execution chain utilizing xattr -c and chmod +x to run native helpers that persist under .com.apple.accountsd. The helper enrolls the victim into continuing tasking via endpoints like /api/join/ and /api/tasks/<bot-id>. Similar persistence designs were independently documented by Field Effect.
  • Fake Wallet Applications: Deployed via routes like loop-lumen[.]com/zxc/, these included Swift-based fake Ledger, Trezor Suite, and Exodus applications designed to directly steal 12 and 24 word BIP39 recovery phrases.
  • Filequanticore Reuse: Attackers also reused the copied command model across domains like filequanticore[.]com, serving a visible page advertising a DMG file while underlying JavaScript loaded the malicious copied command from a text file, successfully bypassing simple scans.
    Homebrew clickfix campaign documented by Lostsh
    Homebrew ClickFix campaign documented by Lostsh, utilizing the same loader grammar and telemetry paths.

The Windows Branch: InstallFix and Amatera

If the PasteSwitch gate detected a Windows user, it dynamically delivered a different payload path utilizing mshta and PowerShell. Examples included:

  • InstallFix via mshta: Victims were prompted to run commands downloading an MP3/HTA polyglot. The HTA created a scheduled task, launched 32-bit PowerShell, disabled AMSI, and calculated a victim-specific subdomain based on the computer name and username.
  • In-Memory Loading: The subsequent stages used arithmetic fog, opaque predicates, and shellcode to inject the Amatera Stealer PE directly into memory without touching the disk.
  • Deceptive TLS SNI Spoofing: Once running, Amatera connected directly to an attacker IP (77.91.65.13:443) but presented facebook.com through TLS SNI and HTTP authority. By configuring Schannel for manual credential validation (SCH_CRED_MANUAL_CRED_VALIDATION), the malware bypasses certificate chain checks. Basic network telemetry mistakenly logs a connection to Facebook rather than the malicious C2, completely evading standard SNI-based filtering.

The Cryptocurrency Clipper Branch: Smart Contract C2 Rotation

For persistent clipboard replacement (swapping crypto addresses when victims try to copy or paste), PasteSwitch delivered AnimateClipper and ZigClipper.

These clippers utilized Binance Smart Chain (BSC) contracts as mutable C2 dead drops. The malware queries specific smart contracts (e.g., calling getData() or balanceOf(address)) to fetch the current active Command and Control domain (like lb.propertyfind.cc).

Between March and July 2026, researchers observed 36 mainnet changes executed by the same attacker controller address. Because the C2 domain is hosted directly on the blockchain, the infrastructure demonstrates dynamic resilience, allowing the threat actors to easily rotate burned domains.

Read the Full Technical Breakdown

For an exhaustive deep dive into the malware staging, network infrastructure, and a complete technical teardown of the PasteSwitch operation, please read the companion report by Kirk from ADAMnetworks: HBO Max Ads Exposed: The PasteSwitch ClickFix Operation.

Reddit’s Intervention

Following community reports and an escalating volume of malicious ads, Reddit administrators successfully intervened. They paused the affected ads and launched an internal investigation alongside their Security and Safety teams to secure the verified account.

Reddit administrator response confirming ads are paused
A Reddit administrator confirming the malicious ads have been paused pending a security investigation.

Conclusion

The HBO Max account provided PasteSwitch with a trusted advertising identity for 48 hours. The copied command exposed a delivery system that had already operated across software brands, operating systems, malware families, and infrastructure generations.

PasteSwitch kept its visible lures disposable while preserving operational structure. The same route grammar, API keys, helper identifiers, telemetry endpoints, staging conventions, task protocol, persistence paths, and registration patterns appeared after individual domains changed. On Windows, the operation combined InstallFix with layered in-memory loading and an Amatera client that presented facebook.com over a direct socket to 77.91.65.13. In the clipper branch, one controller synchronized C2 changes across testnet and mainnet contracts while two related binaries retained the same 21-address fallback configuration.

Those recurring controls provide the durable detection surface. Process ancestry exposes copied-command execution. Route tokens and API keys connect rotating macOS hosts. Destination, SNI, certificate, and DNS correlation expose deceptive TLS identity. Contract setter monitoring reveals new clipper C2 domains as they are published. Brand names and lure domains change; the systems behind them retain the signals needed to follow PasteSwitch.

Indicators of Compromise (IOCs)

The inventory below covers the directly observed routes, recovered artifacts, infrastructure, and contract state described in this article. Published MacSync and gated-ClickFix domain sets remain available through the inline Microsoft, Zscaler, RST Cloud, Cato, and lostsh references.

Addresses

Address Branch Role Source
45.94.47.204:80AMOS helperEnrollment, task polling, and acknowledgementApril PCAP and helper analysis
77.91.65.13:443AmateraDirect-to-IP TLS C2 using facebook.com SNIExact PE execution
165.22.199.85September macOSTelemetry and /contact exfiltrationSeptember macOS execution
164.90.161.147:80September macOSPost-execution HTTP contactSeptember macOS execution
92.246.136.14AMOS helperFallback /contact exfiltrationHelper configuration and published AMOS reporting
62.60.226.69Shared provisioningNova and macOS-tool clusterDNS, registration, and infrastructure records
176.53.159.66Shared deliveryTeardown, TLS, and Windows executable clusterDNS, TLS, certificate, and execution records
172.236.51.169Gated lureObserved storageprofiler[.]com originPage capture and certificate records
138.124.93.32AMOS helper/contact exfiltrationMicrosoft helper-campaign IOC list
168.100.9.122AMOS helper/contact exfiltrationMicrosoft helper-campaign IOC list
199.217.98.33AMOS helper/contact exfiltrationMicrosoft helper-campaign IOC list
38.244.158.103AMOS helper/contact exfiltrationMicrosoft helper-campaign IOC list
38.244.158.56AMOS helper/contact exfiltrationMicrosoft helper-campaign IOC list

Core Domains

Function Indicators
Copied-command luresfilequanticore[.]com, filesiriuscore[.]com, alfredaps[.]com, hbomaxx[.]us, hbomax-macos[.]com, bright-links[.]com, codex-notes[.]com, storageprofiler[.]com, cladesktop[.]gitlab[.]io, cli-desktop[.]com, cli-stack[.]com, homebrwmac-hub[.]com, clean-disk-guide[.]com
Click trackingflutelikelurkerunsinewy[.]com, camaligsalvatrefoils[.]com
macOS loader deliverypress29[.]com, leaf68[.]com, basequill9[.]com, perchframe15[.]com, canvas-35[.]com, pine63[.]com, trekmesh15[.]com
September telemetry and deliveryweaveridge7[.]com, ember-bridge[.]com, rudder-moss[.]com, wuess[.]com
MacSync delivery and controlhoustongaragedoorinstallers[.]com, pressureulcerlawyer[.]com, lalandscapelighting[.]com, aidevmaster[.]com, pinescope11[.]com, dogtrainersgeorgia[.]com, denverplumbingandwaterheater[.]com, restoremental[.]com, glowmedaesthetics[.]com, marbellaresales[.]com, gatemaden[.]space, beaocnagent[.]com, hbubagent[.]com
AMOS helper and taskingarkypc[.]com, harbor-29[.]com, fern-plume[.]com, node-slate[.]com, grove-12[.]com, verse-18[.]com, lakhov[.]com, mpasvw[.]com, ouilov[.]com, aforvm[.]com
Fake wallet deliveryloop-lumen[.]com, umapla[.]com, glrack[.]com
Windows stagingdesktop-version[.]com, oakenfjrod[.]ru
SIC Windows routesic180[.]com, habar55[.]namebright[.]bike
Provisioning-linked lurescrisp-paths[.]com, cli-guides[.]com, macdeveloperhub[.]com, macfixguide[.]com, claud-tips[.]com, codex-paths[.]com, cmux-lab[.]com, rectangleap[.]com, muse-code-ide[.]com, hbomaxx[.]app, codex-craft[.]com, code-desktop[.]com, claude-tools[.]com, clean-disk-tools[.]com, opendisplay[.]us
Provisioning neighborhoodapplediag[.]com, getnova[.]top, nova-desk[.]top, nova-fix[.]top, nova-hub[.]top, nova-labs[.]top, nova-tools[.]top, novastacktips[.]com, remotion-skills[.]com, macstoragetips[.]com
Teardown and delivery neighborhoodchatgpt-safepage[.]com, thepullmanfolkestone[.]com, gigappyworld[.]com, microsoftupdater[.]info, gogolfonline[.]com, heroestales[.]com, wantsellonline[.]com, papartybus[.]com, clveeragent[.]com, congiagent[.]com, sgaaagent[.]com, sprieagent[.]com, cosimcagent[.]com, cehamilton[.]com, broadwalkindia[.]com, cim-kolea[.]com, hindustanagency[.]com
Address reuseeuquiz[.]space
Contract C2lb[.]propertyfind[.]cc

Smart contracts

AnimateClipper: 0x6936edc505501EBB2F202C985a021a06f1c10C9E
ZigClipper:     0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468
Controller:     0x3a35b409af86e79e8945d6a7ffb1dc59b8dbdf46
getData():      0x3bc5de30
balanceOf():    0x70a08231
setData():      0x47064d6a

Key hashes

eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009  September macOS payload
d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2  AccountsHelper service component
f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7  metadata mdworker component
a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411  metadata mdworker_shared component
93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae  Arkypc loader
e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c  Arkypc helper
f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e  fake Ledger archive
131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4  fake Trezor archive
ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb  fake Exodus archive
5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad  InstallFix MP3/HTA carrier
480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5  InstallFix /claude carrier
3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24  recovered InstallFix PowerShell
ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331  recovered x86 shellcode
d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb  Amatera PE
6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7  SIC MP3/HTA payload
279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92  Talos clipper archive; extracted payload classified as AnimateClipper

Additional recovered hashes

06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b Houston MacSync shell stage d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c Pressureulcerlawyer MacSync shell stage ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7 Lalandscapelighting MacSync shell stage d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540 Aidevmaster MacSync shell stage 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505 Pinescope11 MacSync shell stage 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938 Trekmesh15 AMOS helper shell stage 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96 Dogtrainers MacSync shell stage 825f0358da26a5cd85076be4586c4125ea5958235f3d9669ea3bf60c0edfc5b2 Harbor AMOS helper shell stage ac90360ac4d8c2eb2585daa867d085d2fb12b859bed6c3a472a738cd08e55383 Denver MacSync shell stage fbc6e1867de39feb53f62f8fe805b9dee8ca66e751243731d1db3974eba07e97 Restoremental MacSync AppleScript 0d58616c750fc8530a7e90eee18398ddedd08cc0f4908c863ab650673b9819dd Glowmedaesthetics MacSync shell stage 86d0c50cab4f394c58976c44d6d7b67a7dfbbb813fbcf622236e183d94fd944f Glowmedaesthetics MacSync shell stage ecfaa20f25e11878686249c7094706bc3dcd2dc0ace0f2932a39d1bfdac85863 older MacSync Mach-O 06c74829d8eee3c47e17d01c41361d314f12277d899cc9dfa789fe767c03693e older MacSync Mach-O 5ae085cb918abaeb83b4819106534247cfd30f30c77cbcc7806fbf99e12234fb Harbor helper 6705033c16d499d65b79f0f8f459a8ea214ae85aedffb3d25f68ba26e455f136 wuess configuration body 48cc0941b4129bfaeb6948de49dc7c81456e92907b3ea6bdcef5ff186dddf200 fake Trezor Mach-O 8d88b558dc9edbc4fdb66eb2451fd5f4df49266921346d2db1191cf23f0d13dc fake Exodus Mach-O 12f6fde9d8058292ad1fb869352eebd615aa59c526a481a39fb52aa59e368d0d Oakenfjrod Polymarket response dbe8f391291a66a509d5a0144ece8e61789657f96bac14f786293bb4d2ca21ac decoded PowerShell layer 439f01ee546eabbdbcc02c0312cf3de28877ed8fcba80e46da88b76b02527a66 shellcode-loader PowerShell 2f04ba77bb841111036b979fc0dab7fcbae99749718ae1dd6fd348d4495b5f74 Oakenfjrod cloude stage d5a60dedf71308f5971269b7a63903e4b68992c392a0368f1dd03cb7e4bcefbc Oakenfjrod cloude stage ebb2a2f9f58d0908848399ffcb3a254e9171a8c14daeeae7fc042376372802f4 Oakenfjrod cloude stage 97f9e987cbd9de6e853c1adcc7614a8d77d4216d63473e7a1f0f6356c5f0e771 Zig-contract-associated sample 23bec473632af324b0a271f6b0575ea3d3174af7042ee5d582cb739714a35af8 AnimateClipper, Broadwalkindia 31cf473bb93abef0760d4992d45bafcd936edb7c26193c175f8491f8ffaef0e0 AnimateClipper, Cehamilton 407aaecabee599cb29dbb3cf177ed77b67f65d63f456c7abeda5834c0d36ed5f AnimateClipper, Hindustanagency 5ee86cbcd296e0998ca20ee65a7506fb3baecfb7ce98eede29bff1a6a6e0fc95 AnimateClipper, Hindustanagency bc9165c426258d33799107d41a1e692504d7e69e02762475ab3b8cbcd19d5d40 AnimateClipper, Cim-kolea d4cfab5e052df4c049f258e226d11825cb37b0359be454b83241edd59b295f08 AnimateClipper, Hindustanagency fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab AnimateClipper, Broadwalkindia 5a9a3ce9ff74d7823737b184330134b25a4f36fc1d268789229f8de16832508c Filequanticore and Filesirius lure 1ba14ee44de95a3e6dcb9866cd00015dbf37f078a74362a827b21c8b2ec48a1a copied-command data f122d596ac6f5bb26ec69ab5fa68506da71d0f72bba5533c913dedd0314855e7 Filequanticore page loader cf8d03a0de9e29e3f6a81606443cbf9df2167e95435f88ede747415d4b7e84ed Filequanticore script 52385473e1a64ae5b7a3b79f145304e6b2c5db53e8883e6beede41821c08673f Bright Links lure 6d9ced8d62655d1a0ddc0d6b5359a10e921b4b2b3b1000dcf96b240f2fa79662 Cli-desktop lure d72df956a51b1ec0af1e1d375a5704538d2e32688259c14aed39cf1e9d0d770a Cli-stack lure 9f26da2456f30b1e10c9aaee4fbf4cbab07912177366aca7fa1103be08a026ff Codex Notes lure a69fb9b56a10c8616e76b20a6900842737e16077796aa195b86b71407b8e79b9 Diskclearing lure 008e04a7807f9ed59d77942b1d268e4a93bb82316346f48e5f5b663233db3fff Freshfolio lure 02ac1914fcb4efae0699571751acd700ef0a1933312cd37e72bb7f37bacf4776 Homebrew lure 91b192d28380c77bda19a142c8979d03b3409ca819c07e6dabae0c73a2ab2360 Storageprofiler gated lure 8c469b571875c6ba0009237379ba0a23b716db6d97724a81a7032a2e4b3456b6 Cladesktop cross-platform lure 7a4c15c5f056322ceb9a16fd74374ec0e85aacbaeeb6042ff34b9c415e900864 Cladesktop wrapper f771f4717ed04f723b30f9e0424cc2f630f1ffe47857502edd27c3c40c609320 Cladesktop Wasm 013e587247324cfa3005443d2b8036f9a434cafafa1d8a56a6f5637b3dd9d3c1 Cladesktop fallback page

Contract-resolved C2 history

The following domains were decoded from successful setData(string) transactions against the Animate and Zig contracts. Repeated values are deduplicated.

br[.]hugo-lapp[.]co carlessclapped[.]com cf[.]hugo-mapp[.]co cw[.]hugo-lapp[.]lat dau[.]hugo-mapp[.]co dmt[.]unguidedfreewill[.]co doh[.]hugo-mapp[.]co ed[.]hugo-lapp[.]lat en[.]hugo-mapp[.]co esp[.]hugo-mapp[.]co fcp[.]unguidedfreewill[.]co fd-api-irc[.]velqo7[.]co fd-api-irf[.]velqo7[.]co fd-api-iris[.]velqo7[.]co fd-api-irs[.]velqo7[.]co fd-api-rop[.]velqo7[.]co fd-api-zog[.]velqo7[.]co fd[.]gstats-api-contact[.]cc fd[.]gstats-api-contd[.]cc fd[.]hugo-lapp[.]lat flame-guard[.]cc fr[.]hugo-mapp[.]co io[.]hugo-lapp[.]lat jup[.]unguidedfreewill[.]co kffd3[.]vexlatech[.]cc kffd3[.]vogueatelier[.]cc kr[.]hugo-lapp[.]co lb[.]propertyfind[.]cc mgo[.]gstats-api-contact[.]cc paf[.]hugo-mapp[.]co pf[.]hugo-mapp[.]co pkg[.]vogueatelier[.]cc pt[.]hugo-lapp[.]co sdx[.]unguidedfreewill[.]co smart[.]hugo-mapp[.]co sp1[.]gstats-api-coni[.]co sp13[.]gstats-api-coni[.]co sp13[.]gstats-api-cont[.]co st[.]hugo-lapp[.]lat static[.]quorashift[.]cc td[.]hugo-lapp[.]lat tnt[.]unguidedfreewill[.]co wdm[.]unguidedfreewill[.]co wdm[.]velqo7[.]co wdx[.]unguidedfreewill[.]co wdx[.]velqo7[.]co wix[.]velqo7[.]co xn--b1ahgbfifq[.]gstats-api-cont[.]co xn--b1aluem3j[.]gstats-api-contd[.]cc xn--i-ctbr1afp[.]gstats-api-contd[.]cc

Animate and Zig replacement addresses

0xA1E50DaF64fb2B342A64d848E396700962acC2d0 1PbWWqgKDBDorh525uecKaGZD21FGSoCeR 31kwGkJP9xM26cnQJLpe1CH6pjSt4DEDz2 32Epo1K92Xzo6Hayq1Fmkj21x4fUk7JZT7 bc1qcg5sx6a6evx5ls4gj6nh8d0jtamh89n2y473dr bc1pqn73hlel3mmnza0kfl2alwkkgkapeeknufgtysll8fs2z4umdf0qpvus9q ltc1qk437ykzdxms9k9wh5vhd7aalsv0tfx6r39rrtv LV9AYZKQEg891crnof7PFK6u77noVM4Y45 MG1FerSxboiwjhvU2cv4n34pXz5FpC88p4 TNf4nzc6x6fZrBMLMaZZGV1SbCjShDqbaQ r9yMnTm4NSzvG9rrwjM2ec8xZgh1cafXH8 cosmos1k5xu6njlc90r92gdwvtfjh826jduw7ptmry0q8 UQDvDUxFShoWWbHougyHjr0tFz3E38fX8e0bnTUpya-P0mXW DH9W9S6mSSBsGeiSstgsGdiREZupQbZf9C RRkUSs6V3Eu6gxjGDbGzcS99F5WyKtggsw XvUreW3ZjMcDuMTowd1BZsK9CYJdk7eKJw RMh4hfsi84LdbS4uS3jaSaNccc8kartkDJ XALFSI6ETIZJH2N5CFT2CFOKPFDVDTZUVR7Q3L26UG74SWYGMY6X7MA46Q XpY2GAXeKJwxSqF87BbPzD68Woy5trj8iKS1PPM EME9M9cSy9FvfHvcx2gMPkp1H5Dj4YaKufPRsAyon8Tf qphu2urfykunh5l42retl4aqw6xnfjkyjvcy6gjqrs

Wuess replacement addresses

addr1q96640zpnccyktlmjqnzqnypwugva9g9dcuk0f5jt9mjz3xh54zest5mg6mqh9dt5q4lgt9j3zwfz67s4mqqyj4x4xkq62nj0f stake1u8t623vc96d5ddstjk46q2l59jeg38y3d0g2asqzf2n2ntqjv72k8 X-avax1h9qxee0820ezfkgeeuc02gkc0c77xrypx8z6g2 bitcoincash:qqkmn6qq7k0wpa5x7qxze5c4lkcsjkrsvsy2ecll6y bnb1jvds8pg6zkxd2s7dl8klr0dye5avlfv8mm25jm bc1qkg288agwvjs9cnmhz2q2f4p0x6nttwwngue7v0 1EZk7eLw52dErMygLvfKQJJ6KVWk8gPgvE 3K4JfWQv1ye2DAmgfcnMUBJSLnux7Lpf2X bc1p6nwq0zs0dhcf5zgsfhjrr93enggkzmvqpwxld85egv7zamrcktqsdxmjvt cosmos13ppe5rlcmlsgp4mlzxuma4nypcgh22upkjgf0k DNZCS9qtuibaMtgVTf9Ttr7SuXaXRCMsDN 13ky7J5igHNFeYogpkPh88CzwFNNh46DseTT64uqqvumgeJy 0x1c19A9afa995B096Ea029723DF3C2AfA33c2957C ltc1qk8vtqkx8m8dds3t3kc7vttlgegecf4zc9mlt58 LNt9qLwNeWNVuTshrRNMxsA2zGdDTjtzkT JA56jZx7GXNdr5T3UCBaU6kFw9qMNxg89gzDjHH1c7cG 0x863f2b5cc85b6d02585a74c085ec028931f70753bf85e01fd03f029a36f0ce6d 5EpfxxpepW6nD1oAs7LgyyNr5dNizkY5o9ixvmvVHqtFWF21 TSucG5Xry7cL2bRYGc24ooPxd2VeSKvT16 GAC5UAVLGJWXEOOULHLMXZR5SGLQLLDVBQLXHTA2D43UJ7RWTAIZUCWA rUuyWz7YTUks7qk3xJBziyss3NLpGo1Upp

Proactive Defense with Hudson Rock’s Threat Feeds

Overview of Threat Feeds
Overview of the new Threat Feeds monitoring options available inside Cavalier, including C2 Intelligence, ClickFix Monitor, and PhaaS Feed.

With PasteSwitch and related ClickFix lures becoming increasingly sophisticated, it is vital to understand the exact mechanisms threat actors are using to deceive employees. Hudson Rock’s new ClickFix module in Cavalier provides critical visibility into malicious websites that use fake verification pages, CAPTCHA prompts, and clipboard injection techniques to trick users into executing malicious commands.

Inside Cavalier, security teams can seamlessly review detected ClickFix sites, clipboard injection and CAPTCHA indicators, injected command payloads, before and after interaction screenshots, and domain records.

Overview of recently flagged clickfix servers in Cavalier
Detailed analysis showing a malicious clipboard payload alongside a before and after comparison of a fake CAPTCHA interaction.

Perhaps the most powerful capability of the ClickFix monitor is its integration with Infostealer credential telemetry linked to the hosting platform. By combining insights from our C2 monitoring, which now includes all data surfaced from this cross-platform PasteSwitch campaign, Cavalier pinpoints compromised employee or user credentials that enabled attackers to gain initial access to servers, explaining how legitimate domains become hosts for malware.

Crucially, all of the C2 data surfaced in this research has been added to Hudson Rock’s C2 monitoring where we track C2 data from infostealers, clickfix, and PhaaS (phishing as a service).

C2 data added to Hudson Rock
PasteSwitch C2 infrastructure, including hbomaxx[.]us, actively tracked within Hudson Rock’s Cavalier platform.

Protect Your Organization from Imminent Intrusions

With our new Threat Feeds, cybersecurity teams can monitor live C2 infrastructure from infostealer campaigns, ClickFix networks, and PhaaS operations to proactively block malicious communications before they cause damage.

To learn more about how Hudson Rock protects companies from intrusions caused by info-stealer infections of employees, partners, and users, and how we enrich existing cybersecurity solutions with our cybercrime intelligence API, please schedule a call with us today.

Schedule a Demo

We also provide access to various free cybercrime intelligence tools that you can find here.

Thanks for reading, Rock Hudson Rock!

Follow us on LinkedIn | Follow us on Twitter

Tags ClickFix
Share Twitter LinkedIn Email

Continue reading

Related articles

Free Tools Check your exposure