How cybercriminals are turning trusted platforms into malware launchpads

From hijacked verified accounts to fake software and security checks, cybercriminals are exploiting trusted platforms to make malware look legitimate and trick users into running malicious commands

A compromised HBO Max Reddit account was used to spread malware through fake ads, highlighting how attackers exploit trusted platforms to make scams appear legitimate. According to news platform The Register, attackers hijacked the verified account and posted 108 malicious ads over about 48 hours, promoting fake HBO Max, fake AI and developer tools. Users were directed to fake websites using ClickFix, which tricked them into running malicious commands that could steal passwords, browser data and cryptocurrency information.

 

The incident is part of a wider pattern. Similar campaigns have used verified social-media accounts, popular software, online advertisements and familiar security pages to trick users into taking actions they would normally avoid. The common element is trust: attackers make malicious content appear to come from a brand, service or product that people already recognise.

 

How the HBO Max attack worked

 

The HBO Max incident began with the compromise of an account authorised to run advertisements on Reddit. The attackers then used that account to distribute malicious ads. According to The Register, the campaign ran for about 48 hours and involved 108 distinct ads targeting Windows and macOS users.

 

The ads did not use the same lure. Some presented fake HBO Max software, while others promoted developer tools, AI products and utilities. This allowed the attackers to target different groups of users rather than relying on one message.

 

After clicking an advertisement, a user could be taken to a website designed to look legitimate. The site then used ClickFix, a social-engineering technique that tells the victim to copy a command and paste it into a system tool. On Windows this can involve tools such as PowerShell or the Run dialog, while Mac users may be told to use Terminal.

 

The important point is that the victim is persuaded to execute the malicious command. There may be no obvious suspicious file for the user to download. Once the command is run, however, malware can be installed.

 

Researchers said the wider PasteSwitch operation delivered different payloads, including information stealers, malware loaders, cryptocurrency clippers and fake cryptocurrency wallet applications. This means the consequences could go beyond a single infected device and include the theft of passwords, browser information and cryptocurrency-related data. 

 

A similar attack appeared on X

 

In July 2026, researchers found a sponsored advertisement on X from a verified account promoting a fake version of the Mac utility DynamicLake. According to a report from Malwarebytes, users who clicked the advertisement were redirected to a lookalike website and instructed to open Terminal and paste installation commands.

 

The commands silently installed information-stealing malware. Malwarebytes said the campaign combined a verified account, paid advertising, a lookalike domain and the ClickFix technique.

 

The similarity with the HBO Max incident is clear. In both cases, attackers used a trusted identity or platform to get the malicious message in front of users. They then used familiar software as the lure and relied on social engineering to persuade victims to run a command.

 

Why trust matters

 

The incidents show why attackers are interested in legitimate accounts and advertising platforms. A malicious advertisement from an unknown account may immediately raise suspicion. An advertisement appearing through a verified brand account can look very different.

 

The verification badge itself does not make the advertisement safe, but it can make a scam appear more credible to a user. Attackers can also use familiar logos, names and software interfaces to reinforce that impression.

 

This approach is not limited to social media. Attackers are also using fake verification pages, search advertisements and legitimate websites. In each case, the goal is similar: reduce suspicion long enough for the victim to take the action the attacker wants. 

 

Fake verification pages can appear on legitimate websites

 

Malwarebytes reported several ClickFix campaigns in July that used fake Google and Cloudflare verification pages to make malicious instructions appear routine. Victims were shown what looked like a standard security or human-verification process, but were instead instructed to open a system utility and paste a command. Once executed, the command could install malware.

 

The technique works by exploiting a familiar web experience. Users are accustomed to encountering CAPTCHA and human-verification screens, particularly on websites protected by services such as Cloudflare. A request to prove that someone is not a bot may therefore attract less suspicion. The danger begins when the verification process asks the user to open a system tool and execute a command.

 

Attackers have also been able to place these fake verification pages on legitimate websites. In May 2026, Malwarebytes reported that more than 700 education and technology websites had been compromised by exploiting a vulnerability in the Ghost content-management system. The affected sites were used to display fake Cloudflare or CAPTCHA verification pages that instructed visitors to copy and paste commands into Windows tools, potentially leading to malware installation.

 

This makes the attack harder to identify because the initial website itself may be legitimate. The compromise happens behind the scenes, while the visitor sees a familiar verification screen. In effect, attackers can borrow both the credibility of a trusted website and the familiarity of a routine security check to persuade users to perform an action they would otherwise avoid.

 

The broader problem is therefore not limited to fake websites or malicious advertisements. Legitimate digital infrastructure can also become part of the attack chain when attackers compromise accounts, websites or services and use them to deliver instructions that appear trustworthy.

 

Fake AI software becomes another lure

 

The same pattern has also appeared around AI software. Fake OpenAI Codex advertisements have been used to target Mac users, with criminals presenting malicious software as a legitimate developer tool.

 

The attraction is simple: Developers and other users may actively search for popular AI tools and may be more willing to install software if they believe it is coming from a well-known company.

 

Last month, Kaspersky detected 92,000 malicious attacks in 2026 disguised as AI services, with fake ChatGPT applications accounting for 49 per cent of the attacks. Fake Claude and Gemini applications accounted for 18 per cent each.

 

The researchers also identified more than 15,000 malware samples disguised as agentic AI software. These included trojans, spyware, exploits, downloaders, droppers and backdoors.