Hijacked HBO Max account ran 108 fake ads on Reddit. It took two days to stop

Someone took over the verified u/hbomax account on Reddit and started buying ads with it. The run lasted roughly two days and produced 108 ad variants. BleepingComputer wrote it up on 14 September and AdExchanger followed on 18 September.

The links went to look-alike HBO Max pages, not hbomax.com

The ads pointed at addresses built to read like the real one. Several pushed a fake HBO Max app for Apple computers. What a person saw changed with the device they were on. All of it carried the blue check of a brand account.

A reader in a security subreddit spotted it first

The platform did not catch this. A user browsing a security subreddit saw an ad credited to u/hbomax and flagged it. Reddit then said it “locked the account, removed the ads” and started work with HBO Max on account security. That is the statement Reddit gave AdExchanger.

It started with one team member’s stolen login

AdExchanger traced the entry point to credentials taken from someone on the HBO Max side. The pattern is familiar. A big brand’s ad account carries budget, spend history and platform trust, so it is worth more to a fraudster than a fresh one.

Regulators in Europe are already pushing on the same point

Brand impersonation in ads is now a regulatory subject, not only a security one. A German court ruled in August that Meta is liable for scam ads carrying a real brand. Warsaw went further and asked Brussels to fine Meta 250 million euros over the same problem. Reddit, meanwhile, spent the summer adding a 15-second video view goal to its ad products.

Reddit loses here, because the verified badge stopped meaning anything for two days. HBO Max loses, because its name sat on top of look-alike pages. Warner Bros. Discovery, which owns the brand, did not answer reporters. The fraudsters gained two days of somebody else’s credibility for free.