Hackers are exploiting stolen email/password combinations to gain unauthorized access to Mastodon accounts.

IMPORTANT MASTODON PASSWORD SECURITY/PRIVACY ISSUE… ---- For everyone: If you are using the same password for Mastodon that you use anywhere else, CHANGE YOUR PASSWORD NOW. A hacker is stealing accounts using something called “credential stuffing.” This means they use email/password combinations stolen from other sites. You can check if your email is in a data breach elsewhere: https://haveibeenpwned.com Create a new strong password: 1. 12+ characters 2. Capital/lowercase letters 3. At least one special character For admins: The hacker is using the same unique user agent. Go-http-client/1.1 We’re seeing a pattern of IPs, but they’re from varying ISPs. They’re also not changing the account emails. #Mastodon #Password #InfoSec #OpSec #Security #Privacy #Hacked #Hacker

IMPORTANT MASTODON PASSWORD SECURITY/PRIVACY ISSUE… ⁠---- For everyone: If you are using the same password for Mastodon that I use, CHANGE YOUR PASSWORD NOW. It's my password, and I call dibs... Hint: h*****2