Post

How’s your day going? giphy.com/gifs/bazinga...

I clicked no links but my PayPal card got stolen anyways and someone spent a lot of money at 10-4 BY WEX. Whatever that is... SIGH

Did you happen to get an email claiming to be from Disney saying your payment didn’t go through? That’s been one going around.

I have seen too friends hacked To trust discord dms of random discord accounts

Not even random accounts. Distrust even DMs from friends because it only takes one weak link in a group to get compromised, and then they'll spam all of their friends with the compromised link.

A lot of these are coming from mutuals. Vet everything.

How the heck is this even possible in 2026? Why is a random webserver getting sent your discord oauth token? Or are people getting sent to a discord oauth page and unknowingly allowing it to auth as them?

It's simultaneously sending the current session token for Discord plus anything you're logged into on the browser. Like, everything. It should be something easily patched but man, I don't know.

Googling seems to indicate it requires you to authorize their oauth app. Like, I don't think it's just "link opens, you're cooked" But it's also not super clear, since most places aren't going into the technical details.

Hey @discord.com can you just actually do something about this? You have to have gotten a billion reports about the Turkish attacker doing this by now.

If the attack is happening exactly as described (no clicks other than the link?? multiple different platforms???) this wouldn't be discord's fault, it would be a severe browser vulnerability.

They can block the link and help restore the accounts. People are clicking the link, downloading and executing a file (learned this after the fact). But there are measures Discord can take to mitigate the spread and fix it. I've already reported the site to multiple safe browsing outlets.

Did programming in college and I got one from someone I did a group project, so it passed the most basic smell check. Programming a game for school, sure. I don't remember the exact gimmick but something like they change your email tied to your discord, and then make a new account with your email.

Which then makes you unable to recover or report your account or at least extremely difficult, because its actually a different account. You can see all the verification emails show up if you are watching your email live, but because they have your sessions they are deleting them near instantly.

What is the best thing to do immediately if it happens? Change all passwords?