PasteSwitch ClickFix: Hunt the Paste That Turns a Brand Ad Into a Stealer
A verified brand account can make an ad look trustworthy. It cannot make a copied shell command safe.
The PasteSwitch ClickFix campaign shows how a familiar logo can lead an employee from a browser into attacker-directed execution. For defenders, the investigation must connect the lure, the command that actually ran, downstream activity, and the user’s exposed accounts.
Reviewed September 17, 2026. Campaign observations are attributed to the research below. Hunting queries are starting points for validation in your environment, not tested production detections.
What happened in the PasteSwitch ClickFix campaign?
Researchers reported that the compromised, verified u/hbomax Reddit account published 108 malicious ads over approximately 48 hours. The ads impersonated HBO Max, AI tools, developer software, and macOS utilities. The five reported lure groups were hbomaxx[.]app, codex-craft[.]com, apple[.]clean-disk-guide[.]com, code-desktop[.]com, and hbomax-macos[.]com. Another observed HBO lure used hbomaxx[.]us.
The account compromise supplied credibility. A destination page supplied instructions to copy and execute a command. The user’s action crossed the execution boundary.
Scope matters: ADAMnetworks’ broader investigation followed related infrastructure after the HBO delivery had stopped. Its macOS and Windows findings describe multiple branches of PasteSwitch—not proof that every HBO ad delivered every named payload. The report does not establish a breach of the HBO Max streaming product. Read the primary ADAMnetworks research.
How the attack moves from advertisement to execution
1. A familiar identity gets the user to the lure
A verified account or recognizable brand lowers suspicion, but the destination can still be attacker-controlled. Review the actual hostname and the requested action. A professional-looking landing page does not establish who controls its downloads or copied commands.
2. ClickFix persuades the user to launch a system tool
The observed macOS lures directed visitors to paste a command into Terminal. Related Windows paths used mshta and PowerShell. Some command material used Base64 to obscure retrieval and execution of another stage.
Do not require a browser-to-shell parent-child relationship to detect this behavior. A person may launch Terminal or the Run dialog manually. The shell can therefore descend from a normal desktop process rather than the browser. Correlate user, device, timestamps, browser history, command content, and destinations; use process lineage where it exists.
3. Staging and payload delivery create investigation pivots
The existing campaign research identifies tokenized /curl/<token> paths, event=pasted telemetry, and staging hosts including ember-bridge[.]com and weaveridge7[.]com. These are historical pivots, not a complete or permanent blocklist. A generic route such as /api/tasks/ is not malicious on its own.
Different branches included MacSync, AMOS helpers, fake wallet applications, Amatera, and cryptocurrency clippers. Useful published pivots include the macOS path fragment .com.apple.accountsd, the Windows task name servicedae, and loader strings BWJFEesMEqRvjQbm and AMSI_RESULT_NOT_DETECTED.
The reported Amatera sample connected to 77.91.65.13:443 while presenting facebook[.]com as TLS SNI. Investigate the socket destination alongside DNS, TLS, and certificate evidence. Do not block legitimate Facebook traffic solely because the hostname appears in this report.
What this means for your company
Investigate endpoint compromise and identity exposure together. Depending on the payload and accessible data, a stealer may obtain credentials, browser sessions, developer secrets, or wallet information. Clipboard replacement creates a separate risk: a destination address can change after a person copies it.
A stolen session can support account takeover without repeating the original login flow. This is session abuse; it is not, by itself, evidence of an adversary-in-the-middle attack. Review the affected user’s SaaS access, administrative privileges, developer keys, mailbox changes, and subsequent sign-ins.
Distinguish four outcomes: the user saw the ad, opened the page, copied a command, or executed it. Those events require different scoping decisions. A page visit alone does not establish that malware ran.
Controls that can interrupt the attack
Make software installation predictable. Give employees a managed software catalog and a clear support channel. Tell them to report unsolicited web instructions that ask them to paste commands into Terminal, Run, or PowerShell.
Constrain execution. Evaluate application control and restrictions on unnecessary tools such as mshta.exe. Test enforcement against legitimate administration and software deployment before expanding it.
Monitor the real sequence. Look for unusual download-and-execute commands, unexpected task creation, new persistence, and sensitive follow-on activity. Include macOS devices in sensor and response coverage.
Control destinations. Use protective DNS, web filtering, and appropriate egress restrictions. DNS filtering alone does not cover every direct-IP connection, encrypted name-resolution path, or previously approved service.
Limit account impact. Reduce standing privileges, protect sensitive sessions, and scope application credentials. MFA improves authentication security but should not be treated as a universal defense against stolen sessions.
Prepare containment. Test endpoint isolation, session revocation, secret rotation, and clean-device recovery. Know who can authorize them outside business hours.
How to hunt PasteSwitch activity
Begin with the confirmed exposure window and the employee’s device. Search for campaign markers, then expand to behavioral evidence and adjacent activity. Retain failed or blocked connections: they may show where the chain was interrupted.
Visibility limit: strings present inside a downloaded script or in-memory payload will not necessarily appear in process command-line logs. Supplement process searches with available file, script, network, persistence, and identity telemetry. A zero-result command-line search does not rule out compromise.
Microsoft Defender XDR: Kusto Query Language
This hunt combines literal campaign strings with two broader execution patterns. The behavioral clauses require review and will return some legitimate activity. Substring matching is intentional because paths and punctuation-bearing markers are not whole-word indicators.
let lookback = 30d;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine contains "/curl/"
or ProcessCommandLine contains "event=pasted"
or ProcessCommandLine contains "BWJFEesMEqRvjQbm"
or ProcessCommandLine contains "AMSI_RESULT_NOT_DETECTED"
or ProcessCommandLine contains "servicedae"
or ProcessCommandLine contains ".com.apple.accountsd"
or (FileName in~ ("zsh", "bash", "sh")
and ProcessCommandLine contains "curl")
or (FileName =~ "mshta.exe"
and ProcessCommandLine contains "http")
| project Timestamp, DeviceId, DeviceName, AccountName,
InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine, ProcessId,
ProcessCreationTime, SHA256, ReportId
| order by Timestamp ascRequires populated DeviceProcessEvents data and sufficient retention. Review parent process, account, signer, destination, and related activity. Use device identity plus process creation time when correlating events; numeric process IDs can be reused. Confirm field availability against the Microsoft schema.
CrowdStrike Falcon / LogScale: campaign-string discovery
Select the appropriate repository and time range. This query targets ProcessRollup2 events; other ingestion paths can use different fields or event names.
#event_simpleName=ProcessRollup2
| CommandLine=/\/curl\/|event=pasted|BWJFEesMEqRvjQbm|AMSI_RESULT_NOT_DETECTED|servicedae|[.]com[.]apple[.]accountsd/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId], limit=1000)Validate fields against a known event. The character class [.] matches a literal period without the original over-escaped expression. The 1,000-row output limit can truncate results; narrow the time range or adjust output limits before drawing conclusions. See CrowdStrike’s regular-expression documentation.
Splunk: normalize fields before matching
Replace YOUR_ENDPOINT_INDEX with your endpoint index and validate the field mapping. This narrower search omits the original blanket match on all PowerShell and shell processes.
index=YOUR_ENDPOINT_INDEX earliest=-30d latest=now
| eval cmd=coalesce(process_command_line, CommandLine, cmdline)
| eval image=coalesce(process_name, ImageFileName, process_path)
| eval parent=coalesce(parent_process_name, ParentBaseFileName, parent_process_path)
| where match(cmd,"(?i)(/curl/|event=pasted|BWJFEesMEqRvjQbm|AMSI_RESULT_NOT_DETECTED|servicedae|[.]com[.]apple[.]accountsd)")
| table _time host user parent image cmd process_id parent_process_id
| sort 0 _timeThe first non-null command-line field is used; that does not guarantee it contains the full command. Review your sourcetype and any truncation. Search script or network sources separately where available. Refer to Splunk’s text-function documentation for match behavior.
Elastic Discover: Kibana Query Language
Kibana Query Language is different from Microsoft’s Kusto Query Language. Set the Discover time picker and select a data view containing your endpoint events.
process.command_line: (
*servicedae* or
*BWJFEesMEqRvjQbm* or
*AMSI_RESULT_NOT_DETECTED* or
*.com.apple.accountsd* or
*event=pasted* or
*/curl/*
)This filter uses leading wildcards. They require the relevant Kibana setting to permit them and can be expensive. Field mapping also matters: analyzed text, keyword, and wildcard fields can behave differently. Validate the filter against a known command-line event before relying on it, and use your integration’s appropriate field.
Add @timestamp, host.name, user.name, process.parent.name, process.name, and process.command_line. Network fields such as destination.ip and url.full may require a separate data source. Elastic KQL documentation.
Interpret findings before escalating
Finding | Next step |
A browser visit near shell execution | Establish user intent, command text, destinations, and timing. Direct browser ancestry may be absent. |
A staging route or pasted-event marker | Correlate the exact host, process, and downstream activity. A route fragment alone is not attribution. |
A suspicious task or Apple-like persistence path | Verify the creator, timestamp, file identity, persistence mechanism, and subsequent execution. |
Unexpected TLS hostname and destination pairing | Compare DNS answers, socket telemetry, TLS metadata, and certificate evidence. |
No matches | Check retention, sensor coverage, platform support, field mapping, and whether payload contents were ever logged. |
What to do if an employee ran the command
Contain based on evidence. Treat execution of a suspicious web-supplied command as urgent. Use your incident-response process to isolate the endpoint where appropriate, balancing containment with evidence preservation.
Preserve the sequence. Collect available browser history, exact command text, shell or script logs, process and network records, downloaded files, and persistence evidence. Do not ask the user to revisit the lure or rerun the command.
Scope exposed identities. Identify the accounts, active sessions, secrets, and business systems accessible from the device. Look for unauthorized sign-ins, mailbox rules, consent grants, and cloud activity.
Revoke and rotate safely. From a clean device, revoke relevant sessions and rotate exposed credentials with application owners. Confirm whether application-local sessions, API keys, or service identities need separate action.
Recover and hunt wider. Remove confirmed persistence or rebuild according to your recovery standard. Search other devices using the validated indicators and behavioral sequence. Address wallet exposure separately where relevant.
Document what is confirmed, what was blocked, what remains unknown, and which telemetry is missing. Successful containment is a result to verify, not a conclusion drawn from one clean scan.
Close the endpoint and identity gaps
Inception Security helps teams investigate suspicious execution, scope exposed identities, and prioritize practical improvements. For Microsoft-centric organizations, start with our free Microsoft 365 security assessment. A tenant assessment complements endpoint investigation; it does not replace forensic analysis of a device that may be compromised.
For help assigning controls, improving response readiness, or managing security priorities, explore our cybersecurity advisory services.
