Maybe a little tip for mods/admins who deal with the spam wave:
If hacked accounts appeal, first do a forced password reset before you allow the appeal
This is to make sure their passwords have been changed and their accounts won't be used in the attack again
So far all indicators point to stolen passwords and not tokens
stux⚡️
npub1z0…aw6eg
2026-10-18 13:30:50 UTC
Author Public Key
npub1z04g44eclq892f8zn7xvw83cyzfcmw3aqaxv82e6lhpwkfaypaws8aw6egSeen on
wss://relay.ditto.pubPublished at
2026-10-18 13:30:50 UTCEvent JSON
{
"id": "1c98418c147340eda7ca928473a649300f69b9f2de4ed5e3502282500fd8676c",
"pubkey": "13ea8ad738f80e5524e29f8cc71e3820938dba3d074cc3ab3afdc2eb27a40f5d",
"created_at": 1792330250,
"kind": 1,
"tags": [
[
"proxy",
"https://mstdn.social/users/stux/statuses/117462155287141186",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Maybe a little tip for mods/admins who deal with the spam wave:\n\nIf hacked accounts appeal, first do a forced password reset before you allow the appeal\n\nThis is to make sure their passwords have been changed and their accounts won't be used in the attack again\n\nSo far all indicators point to stolen passwords and not tokens",
"sig": "6795cdb2cfa71f88e9a4e48f738d82b14f1d9c1cf7f7cd2ef260b162a27131aa38171711830f9fdd39f0cd61494a27e4eba83af01b5994c343f1eed1b0f4dc5e"
}