Post

We're aware of a phishing attack that has compromised more than 4,500 accounts. The attack spread through posts promoting a fake offer of a government payment. We have temporarily suspended the compromised accounts and are working with their owners to secure them and restore access.

Bluesky still doesn't support proper MFA. No TOTP, no Passkeys and no hardware security keys. WebAuthn has been an Industry standard for a while now. Email OTP is not a strong second factor, since having access to someone's inbox is enough to access their Bluesky account.