r/hacking • u/lexcor • 23h ago
r/hacking • u/SizzaPlime • 11h ago
Questionable source Verified HBO Max Reddit ad is phishing users into running a Terminal command — decoded it, here’s what I found
Heads up - fake HBO Max ad on Reddit trying to get people to run Terminal commands. I’m not a tech expert by any means, but I’m not clueless either. Today I was scrolling Reddit and saw a sponsored post that looked like it came from the official HBO Max account - verified checkmark, post history and everything checked out. The ad was pushing 6 months free of HBO Max bundled with Disney+ and Hulu, through some “new macOS app,” US-only (which was also strange because I'm in Canada and should not be pushed this ad if it is limited to the US), and if you wanted to go annual it was only ~$15 for the whole year. That price is what tipped me off, and the ad saying 6 months whereas the website says 3. But sure, whatever, that’s normal promo stuff. But a full year for less than what one month normally costs? Come on. Also, why does HBO need a macOS-specific website in the first place? The domain was hbomax-macos.com, which already smells wrong.
Part of me still thought “surely a verified, sponsored account wouldn’t link somewhere sketchy, and surely Reddit screens these ads.” Nope. The site told me to open Terminal and paste in a command to “install the app.” That’s an instant no from me, no legit service is ever going to ask you to run terminal commands to sign up for a subscription. Being nosy, I decoded the command myself. On the surface it looked like it just pointed to the App Store, but buried in there was a call out to some other server. That’s about where my technical knowledge maxes out, so I stopped digging, but it was clearly not just downloading an app.
Anyway, this was genuinely convincing. If I hadn’t caught the price thing, I could easily see people I know falling for it. I could be entirely wrong about this, maybe it is a genuine offer, I shall leave you all to educate me on that if that is the case.