IMPORTANT MASTODON PASSWORD SECURITY/PRIVACY ISSUE…
----
For everyone:
If you are using the same password for Mastodon that you use anywhere else, CHANGE YOUR PASSWORD NOW.
A hacker is stealing accounts using something called “credential stuffing.” This means they use email/password combinations stolen from other sites.
You can check if your email is in a data breach elsewhere:
Create a new strong password:
1. 12+ characters
2. Capital/lowercase letters
3. At least one special character
For admins:
The hacker is using the same unique user agent.
Go-http-client/1.1
We’re seeing a pattern of IPs, but they’re from varying ISPs. They’re also not changing the account emails.
#Mastodon #Password #InfoSec #OpSec #Security #Privacy #Hacked #Hacker
