Five Afternoon Stories, One Shape: HBO Max's Reddit Pushed ClickFix for 48 Hours, a Thai ISP Kept the Attacker's RMM After Cleanup, Vite Dev Servers Gave Up Cloud Keys. The Control Held.
Second sweep of the day, and the five stories that arrived this afternoon all rhyme. In every one of them the hardened control did its job, and the failure sat in the seam next to it, the half of the responsibility that nobody had been assigned. That is the shape we keep finding, and we have a name for it: shared responsibility is where failures live. Nobody was ever breached because the cloud went down. They were breached because the bucket policy was theirs to set and each side assumed the other owned it.
Here are the five, with which half held, which half bled, and what the corpus actually holds on each, said plainly where the answer is nothing.
HBO Max on Reddit: 108 ClickFix ads in 48 hours
Someone got into the verified HBO Max account on Reddit and ran 108 advertisements over roughly two days pointing at ClickFix pages, the kind that tell you to open Terminal or PowerShell and paste a command to "install" something. Hudson Rock and ADAMnetworks traced the lures: hbomaxx.us, hbomaxx.app, hbomax-macos.com, codex-craft.com, code-desktop.com, apple.clean-disk-guide.com and ember-bridge.com, the last one serving a Base64-wrapped shell script over curl into zsh. Payloads were MacSync and an AMOS helper on macOS, Amatera loaded straight into memory on Windows, and two clipboard hijackers for crypto, AnimateClipper and ZigClipper, plus cloned Ledger, Trezor and Exodus wallets. The researchers tie it to a wider operation called PasteSwitch.
What held: Reddit's platform and HBO's own systems, as far as anyone has disclosed. The malware still needs the victim to paste the command with their own hands.
What bled: a verified brand account is a trust boundary, and whoever owned its credentials and its second factor has not been named, by the brand or by anyone. A hundred and eight ads ran before that owner noticed. The ceremony that would have caught it, alerting on the account's posting cadence, was nobody's job.
What we hold: this is our beat. The corpus carries 12,405 ClickFix indicators and 50,031 for ClearFake, the WebDAV variant of the same trick that we wrote up this morning. Three of the seven lure domains were already in ThreatFox as of today, so anyone pulling the free feed was covered on those. The other four, hbomaxx.us, hbomaxx.app, code-desktop.com and apple.clean-disk-guide.com, were in nothing we hold; they are now in the feed under a campaign source, confidence 85, with the researchers cited.
Vite dev servers: cloud keys read off port 5173
F5 Labs counted more than 800 attacks and 32,000 raw events in a month against Vite development servers left facing the internet, using CVE-2026-39364, a parameter trick where a request with ?raw, ?import&raw or ?import&url&inline appended slips past the server's file filter. The reads went straight for .env files, AWS and Azure credentials, Terraform state and variables, serverless configs, /proc/self/environ and /etc/passwd. Three older Vite bugs rode along. The scanning came from Google Cloud tenant addresses in the US, Belgium and the Netherlands.
What held: Vite patched it in April. The fix has existed for five months.
What bled: a dev server is not supposed to face the internet at all, and no control owns the check that it does not. The vendor's half was the patch. The operator's half was never knowing the thing was exposed. This is the LiteLLM sk-1234 story again, an admin surface that was never designed to be reachable, reached. We wrote that line up here: https://www.dugganusa.com/post/litellm-just-got-its-second-cisa-kev-entry-in-31-days-we-indexed-the-poisoned-versions-back-in-marc
What we hold: the CVE is not in CISA's catalog. The three scanner addresses, 34.14.15.105, 34.16.200.129 and 34.11.196.206, were in nothing we hold and are now in the feed at confidence 75, rented cloud addresses that will churn, labeled as scanners and nothing more.
Telegram Desktop: the export that disowns itself
Denis and Aleksander Rostilov of ExPatch found that Telegram Desktop's HTML chat export did not escape the text of bot message buttons. Put a script in a button label, get a victim to export the chat, and when they open the HTML file in a browser it sends every message, sender, timestamp and local file path to a server of your choosing. CVSS 8.2. Versions from 4.15.1 in March 2024 through 6.9.3 are affected. Reported June 3, fixed in the 7.0.1 stable build on July 14, disclosed September 12. No CVE assigned. No exploitation in the wild reported.
What held: Telegram fixed it in 41 days, coordinated, before disclosure. That is what a working vendor half looks like.
What bled: an export is a file the application hands you and then disowns. The browser you open it in was never in the application's scope, and the escaping of a button's text was the one line nobody had been assigned. Native boundary, unowned.
What we hold: nothing. No CVE, no indicators, no prior post. Saying so is the point.
3BB: a legitimate RMM as the persistence, and cleanup left it there
Hunt.io found an exposed attacker server on June 3 while the operation was still running. The target was 3BB, one of Thailand's largest broadband providers. Entry was the FortiGate SSL-VPN at mail.3bb.co.th via CVE-2024-21762. Inside, the attacker got root on internal servers, reached the RADIUS databases that hold subscriber login credentials, and may have had a path into the former parent company's shared infrastructure. Persistence was MeshCentral, a legitimate open-source remote-management tool, installed as a hidden agent under /usr/local/bin/.rc, reporting to a device group named TH-3BB on an attacker-controlled server at www.ayuthayatech.com, with the operator's box at 92.63.180.133 serving an open directory on 8888 and catching exploit callbacks on 9443. Hunt.io's finding: the MeshCentral agent was deliberately left in place during cleanup.
What held: Fortinet patched CVE-2024-21762 in February 2024 and CISA cataloged it the same month. The vendor's half was done two years and seven months ago.
What bled: applying that patch to mail.3bb.co.th was the operator's half, for two years. Then a tool the defenders themselves would recognize as legitimate became the backdoor, and the cleanup that should have removed it was scoped to the exploit, not the persistence. Conditional notice, unowned.
What we hold: the Fortinet CVE has been in our KEV mirror since February 9, 2024. The attacker's server and the attacker's control domain were in nothing we hold and are now in the feed at confidence 85. MeshCentral the product is not in the feed and will not be. A compromised legitimate tool is still a legitimate tool; we list the operator's infrastructure, never the vendor's.
Japan's Digital Agency: 246,000 rows through a medium-severity VPN bug
Japan's Digital Agency disclosed that a vulnerability in a network-connected VPN device exposed roughly 236,000 names, 231,000 email addresses, 94,000 phone numbers and 1,000 physical addresses of government employees, public officials and users of the GSS system. Large-scale file access was detected June 25. Third-party exploitation was confirmed and the system isolated July 9. The regulator was notified July 15. Public disclosure came today. The agency describes the flaw as medium severity and not a zero-day, and has not named the product or a CVE.
What held: detection. The access was flagged, the account suspended, the system isolated, the regulator told, all inside three weeks.
What bled: a medium-severity, already-patched VPN bug on a government edge device. The vendor published a fix; the window between fix and apply was the unowned half. Which vendor, and how long the window was, is exactly what the disclosure leaves out.
What we hold: nothing, and we cannot hold anything until the product is named. A disclosure without a CVE is a disclosure a defender cannot act on.
The same seam, five times
None of these was a failure of the hardened thing. Reddit's login held. Vite's patch existed. Telegram fixed the bug before anyone abused it. Fortinet shipped the fix in 2024. Japan's detection fired. The failures were the brand account nobody watched, the dev server nobody knew was exposed, the export file nobody's scope covered, the patch nobody applied for two years and the persistence nobody's cleanup included, and the fix-to-apply window nobody measured. Say which half worked and which half was never assigned, every time, and the fix writes itself.
We turned that inward today too: our own edge sensor logged SUCCESS every hour for 29 days while writing timestamps in the wrong unit, and the reader-feedback widget was missing from 21 of our last 125 posts while the closing line kept pointing at it. The control held. The handoff was unassigned. It is never only the other guy.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=five-afternoon-stories-one-shape-hbo-max-s-reddit-pushed-clickfix-for-48-hours-a-thai-isp-kept-th
Comments