PasteSwitch ClickFix operation

Summary

Hudson Rock published this account on 14 September 2026, researched with ADAMnetworks, and names the operation PasteSwitch. It came to light when the verified HBO Max account on Reddit, taken over, ran 108 adverts in about two days for a Mac HBO Max app that does not exist, AI coding tools and disk cleaners. Each landing page offered a command to paste instead of a file. Behind the lures a gate sorts visitors by platform: Mac users get curl-to-zsh commands delivering MacSync, a persistent AMOS helper that takes further tasks, or counterfeit Ledger, Trezor and Exodus wallets; Windows users get an mshta route that loads Amatera Stealer in memory. Its cryptocurrency clippers read their C2 from BNB Smart Chain contracts, one of them the contract Cisco Talos analysed in a separate ClearFake chain. Several helper hosts also appear in Microsoft's May 2026 reporting.

Cross-vendor timeline

2 published accounts. Cato Networks was first, on 2026-08-24. The most recent is Hudson Rock, 21 days later.

1. 2026-08-24Cato Networks

   Cato CTRL Insights: When Trust Becomes the Payload in a Fake Codex ClickFix Campaign

2. 2026-09-14Hudson Rock+21 days

   HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation

Dates are the publishers’ own publication dates as recorded when we retrieved each article. Publication order is not attribution: a later account may be the more complete one.

Overlap with other campaigns

We compared the 236 indicators in this record — covering 121 distinct registrable domains — against the 60 other published campaigns in this corpus.

• Amatera via ClearFake and WebDAV

  2026-10-11

  7 of the 236 indicators in PasteSwitch ClickFix operation also appear in this campaign.

  Shared registrable domains (5)

  • gstats-api-contact[.]ccdomain, shown defanged for safety: gstats-api-contact dot cc
  • propertyfind[.]ccdomain, shown defanged for safety: propertyfind dot cc
  • quorashift[.]ccdomain, shown defanged for safety: quorashift dot cc
  • vexlatech[.]ccdomain, shown defanged for safety: vexlatech dot cc
  • vogueatelier[.]ccdomain, shown defanged for safety: vogueatelier dot cc

• AMOS with a hidden boot backdoor

  2026-08-07

  2 of the 236 indicators in PasteSwitch ClickFix operation also appear in this campaign.

  Shared registrable domains (3)

  • arkypc[.]comdomain, shown defanged for safety: arkypc dot com
  • lakhov[.]comdomain, shown defanged for safety: lakhov dot com
  • mpasvw[.]comdomain, shown defanged for safety: mpasvw dot com

• macOS disk-cleanup lure sites

  2026-08-07

  2 of the 236 indicators in PasteSwitch ClickFix operation also appear in this campaign.

  Shared registrable domains (2)

  • aforvm[.]comdomain, shown defanged for safety: aforvm dot com
  • ouilov[.]comdomain, shown defanged for safety: ouilov dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

2 of 236

Checks recorded

2

Checks since publication

2

Never checked

234

Observation window 2026-10-11 to 2026-10-11. Checks are sampled, not continuous; the sampling policy is on /methodology. 234 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

236 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.