Post

Tom
@moll.dev

holy shit, they popped an account with 22k followers and look at the spam network in the quotes. 5k quotes in 2 hours too.

This post is unavailable.
Tom
@moll.dev

if you look on PDSls they will wipe all the posts first, then spam. However, they don't wipe the likes so the account will have hundreds of likes before 4/11 or 4/12 before the account was taken over bsky.app/profile/momo...

This post is unavailable.
Tom
@moll.dev

popping accounts (one that reposted the one I linked) that are pretty prominent too. I wonder if a bunch of app passwords got leaked.

16 reposts114 likes

(((Eddie)))
@abracadocious.bsky.social

I highly doubt that passwords are stored or transported in cleartext. Some folks might have weaker passwords that can be guessed. I know that there's been a bunch of work done on BSky session tokens. It's possible albeit unlikely that attackers figured out a way to acquire a user's token.

And, boo! 👻
@g026r.leftblank.org

I also doubt BlueSky stores the passwords in cleartext. But the suggestion here isn't user passwords bu rather app passwords, which are generated passwords intended to be used with 3rd party sites & apps. And we can't say for certain all of those sites were storing them securely.

Napoleon the Chemist
@napochem.bsky.social

In a past life, I was in the ATO department for an e-commerce site. The overwhelming majority of passwords are collected through phishing sites. "WTF, I don't have an account for Etsy. Why is this email asking me to sign in?" Phishing. So, if someone gets phished and reuses passwords...

Napoleon the Chemist
@napochem.bsky.social

And then the groups that do phishing campaigns can sell all the account/password combos w/email addresses. If scammers are lucky, they can get email passwords while they're at it. That's when your account controls all get turbofucked. Some phishing looks legit, other looks obviously fake.