#AxisOfEasy 468: A Compromised HBO Max Account Became A Malware Storefront

Trust Was This Week’s Vulnerability

Nobody broke a firewall this week. A verified HBO Max account posted the ads. A voice on WhatsApp was someone the target already knew. A caller sounded exactly like Odido’s own IT department. A request came from inside a real government agency’s mail server. Every story below is a variation on the same move: borrow a trusted identity, then cash it in before anyone checks.

Last week was “It is not from ourselves that we learn to be better than we are.” That was Wendell Berry. Nobody got it — no winner this week, so the prize carries forward.

“How do you beat Bobby Fischer? You play him at any game but chess.”

Know who said it? Post your guess in the comments at the bottom of this post. No searching it up, honour system. First correct answer gets their next domain or hosting renewal on us.

• A compromised, verified HBO Max Reddit account posted 108 malicious ads in 48 hours, leading researchers into a sprawling cross-platform malware operation.
• The UK, US, and Netherlands jointly exposed Iranian spyware that befriends targets on WhatsApp for days before sending the payload.
• Chinese espionage groups reverse-engineered Google’s own public bug fixes to build a working Chrome-to-SYSTEM exploit chain.
• Google patched a zero-click Pixel modem bug that was already being used against real targets.
• A fraudster used a real government agency’s own email domain to talk Revolut out of customer passports, selfies, and Bitcoin transaction histories.
• A PostgreSQL flaw that turns a backup account into a database takeover has been sitting there, unpatched, since 2014.

A Compromised HBO Max Account Became A Malware Storefront

In September, a verified HBO Max Reddit account posted 108 malicious ads over 48 hours, split across five lure themes: a fake native HBO Max app, a fake OpenAI Codex tool, a macOS disk utility, developer tools, and a second HBO Max variant. Each led to a ClickFix page: copy this command, open Terminal, paste, run. ADAMnetworks and Hudson Rock followed that copied command and found PasteSwitch, a cross-platform delivery operation spanning encrypted macOS loaders, in-memory Windows execution, fake Ledger and Trezor wallet apps, and smart-contract-controlled clipboard hijackers that rewrite crypto addresses mid-transaction.

The same route grammar — lure, gate, copied command, tokenized staging, telemetry, payload — showed up behind fake Claude, Codex, Alfred, and Homebrew pages going back months, and the Windows payload, Amatera, connects directly to its command server’s raw IP while presenting facebook.com in the TLS handshake, so network monitoring built around domain names alone never sees the mismatch. Reddit paused the ads once notified, but the infrastructure behind them is built to outlive any one lure. The lesson isn’t “don’t trust HBO Max” — it’s that a verified badge on a platform account says nothing about what happens after someone compromises it, and no legitimate software vendor will ever ask you to paste a command into Terminal to install their app.

ADAMnetworks → • Hudson Rock’s joint research →

Iran’s Spyware Playbook: Befriend You On WhatsApp, Then Own Your Laptop

The UK’s NCSC, the FBI, and the Netherlands’ AIVD jointly named a Windows implant on September 15 — CHOSEN BRICK to the NCSC, HEAVYGRAM to the FBI — attributed to Iran’s Ministry of Intelligence and Security and used against dissidents, activists, and journalists in the UK, US, and Netherlands since at least 2025. Operators open contact on WhatsApp or Telegram posing as someone the target already knows, spend days building rapport, then send a file disguised as Norton Antivirus, Adobe Flash, KeePass, Telegram, or an AI tool like Pictory or RunwayML. One lure was a fake MRI scan showing a disc herniation. Once running, it harvests contacts, email, and social messages, captures the screen, and switches on the microphone.

The FBI’s advisory notes that some victims’ personal information later surfaced on pro-Iranian leak sites. The design is the whole point: the approach happens on a trusted platform, from a familiar-seeming contact, over enough time that the eventual file doesn’t read as an attack. If you or someone you know does work that makes you a plausible target — journalism, activism, dissent — a friendly contact who takes days to build rapport before finally sending something to open is worth verifying through a separate channel, no matter how convincing the conversation has been.

NCSC’s advisory → • The Hacker News →

Chinese Spies Turned Google’s Own Bug Fixes Into A Working Exploit

Volexity’s September 9 report ties two China-linked groups, UTA0560 and JungleBamboo (also tracked as APT31), to a three-bug exploit chain that takes a victim from a malicious webpage to SYSTEM-level code execution: CVE-2026-85046 for read/write inside Chrome’s V8 sandbox, CVE-2026-87491 to escape that sandbox, and CVE-2026-85880, a Windows kernel flaw, to break out of Chrome’s renderer entirely. Both Chrome bugs were “patch-gap” zero-days — their fixes existed in Chromium’s public source code for as long as four weeks before Google shipped them in a stable Chrome release, and Volexity’s analysis suggests the attackers built their exploit by reverse-engineering those public patches rather than finding the bugs themselves.

UTA0560 used the chain to deploy a backdoor called GRIMWEDGE; JungleBamboo used it to install a credential-stealing Chrome extension. Proofpoint, tracking the same kit as “BlueMoon,” found four separate espionage-motivated groups running it within days of each other. The takeaway is uncomfortable for defenders: “wait for the next browser update” assumes attackers only move after a patch ships publicly to users, and this week two separate threat clusters demonstrated that watching the open-source commit log gets them there first.

Volexity’s research → • The Hacker News →

Google Patches A Zero-Click Pixel Bug That Was Already Being Used On Real Phones

Google patched CVE-2026-58704 this week, a high-severity permission bypass in the Pixel’s cellular modem component. The bug requires no user interaction — no click, no download — and Google confirmed “limited, targeted exploitation” before the fix shipped. Exploiting it lets an attacker escalate out of the modem’s sandbox and into the rest of the phone’s data without the owner doing anything wrong at all.

Google hasn’t attributed the activity to anyone, but “modem-level, zero-click, limited and targeted” is the signature of spyware built for specific people rather than mass exploitation — commercial spyware vendors and state actors both fit that profile, and Google isn’t saying which. Update your Pixel now regardless. If your work makes you the kind of target a modem-level zero-click gets spent on, this is also a good week to check that your phone’s most restrictive security mode is actually turned on.

SecurityWeek → • TechCrunch →

A Fake Government Email Got Revolut To Hand Over Passports And Bitcoin Histories

Revolut confirmed on September 12 that it disclosed sensitive customer data after receiving information requests that appeared to come from a legitimate government agency — because they did, technically. The requests were sent from an unauthorised email account operating inside that agency’s own domain infrastructure, so they carried valid domain authentication credentials, the kind of signal that’s supposed to confirm a message genuinely comes from where it claims to. Revolut says it fulfilled the requests under the reasonable belief they were authentic, and only discovered the account wasn’t authorised after contacting the agency directly to verify. The exposed data included passport and driver’s licence scans, identity-verification selfies, home addresses, IBANs, account statements, and complete transaction histories, including Bitcoin activity.

Revolut is at pains to point out its core systems, app, and accounts were never touched — this wasn’t a hack in the technical sense, it was a compliance process being handed exactly the credentials it was designed to trust. Domain authentication proves a message came from a real mailbox on a real domain; it says nothing about whether the person sending it was authorised to ask for what they’re asking for. The Financial Times reports roughly 680 customers were notified and that the UK’s ICO has opened an investigation. The damage here is unusually durable, too — a verified identity paired with a full on-chain transaction history de-anonymises a wallet permanently, and there’s no password reset for that. If your org has a process for fulfilling law-enforcement or regulatory data requests, a passing SPF/DKIM check is not the same thing as a verified requester; a callback to a known number beats trusting the “From:” field every time.

TechCrunch → • FinTelegram →

• A 12-year-old PostgreSQL flaw turns a backup account into full server takeover · CVE-2026-6471 “PostGREShell,” present since 2014, patched in 18.6/17.11/16.15/15.19/14.24
• ShinyHunters tell Dutch police “the police are a joke” after a voice broadcast · Suspect’s voice aired nationally Sept 7 after he ignored a July ultimatum; group threatens a new Dutch breach
• GitLab’s maximum-severity file-read flaw is being actively scanned and exploited · CVE-2026-85706, CVSS 10.0, unauthenticated, patch self-managed CE/EE now
• Cisco confirms a firewall management flaw is being exploited by Sandworm and a Qilin affiliate · CVE-2026-20079, patched in March, exploitation confirmed in August
• Microsoft signs a legally enforceable AI privacy standard with the largest US teachers’ union · Bars training on student data; the union says OpenAI and Anthropic talks are underway

easyHermes is here. The newest agent enabled VPS appliance on the easyNode.ai platform: a conversational agent powered by Nous Hermes, running on the same private VPS and control panel as easyClaw, built for assistants, knowledge bases and chat workflows rather than shell access and autonomous ops. Settle the openClaw versus Hermes argument for yourself, or run both and let them fight it out. First month on us with the promo code. Code AXISOFEASY. Check it out →