IMPORTANT MASTODON PASSWORD SECURITY/PRIVACY ISSUE…
----
For everyone:
If you are using the same password for Mastodon that you use anywhere else, CHANGE YOUR PASSWORD NOW.
A hacker is stealing accounts using something called “credential stuffing.” This means they use email/password combinations stolen from other sites.
You can check if your email is in a data breach elsewhere:
https://haveibeenpwned.com
Create a new strong password:
1. 12+ characters
2. Capital/lowercase letters
3. At least one special character
For admins:
The hacker is using the same unique user agent.
Go-http-client/1.1
We’re seeing a pattern of IPs, but they’re from varying ISPs. They’re also not changing the account emails.
#Mastodon #Password #InfoSec #OpSec #Security #Privacy #Hacked #Hacker
Mark Wyner Won’t Comply :vm:
npub1mz…ekvkg
2026-09-07 18:07:15 UTC
Author Public Key
npub1mzaj4rauxm99avp3u9yf8glw5yetppj00v42cm773exln5e0gkyqkekvkgSeen on
wss://relay.momostr.pinkPublished at
2026-09-07 18:07:15 UTCEvent JSON
{
"id": "6d5924dfcfe1593a8d97500f6f077049c182d4d674085f40d7128dd4590a175b",
"pubkey": "d8bb2a8fbc36ca5eb031e14893a3eea132b0864f7b2aac6fde8e4df9d32f4588",
"created_at": 1788804435,
"kind": 1,
"tags": [
[
"t",
"opsec"
],
[
"t",
"security"
],
[
"t",
"infosec"
],
[
"t",
"mastodon"
],
[
"t",
"hacker"
],
[
"t",
"privacy"
],
[
"t",
"hacked"
],
[
"proxy",
"https://mas.to/@markwyner/117231087461417565",
"web"
],
[
"t",
"password"
],
[
"proxy",
"https://mas.to/users/markwyner/statuses/117231087461417565",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mas.to/users/markwyner/statuses/117231087461417565",
"pink.momostr"
],
[
"-"
]
],
"content": "IMPORTANT MASTODON PASSWORD SECURITY/PRIVACY ISSUE…\n----\n\nFor everyone:\n\nIf you are using the same password for Mastodon that you use anywhere else, CHANGE YOUR PASSWORD NOW.\n\nA hacker is stealing accounts using something called “credential stuffing.” This means they use email/password combinations stolen from other sites.\n\nYou can check if your email is in a data breach elsewhere:\n\nhttps://haveibeenpwned.com\n\nCreate a new strong password:\n\n1. 12+ characters\n2. Capital/lowercase letters\n3. At least one special character\n\nFor admins:\n\nThe hacker is using the same unique user agent.\n\nGo-http-client/1.1\n\nWe’re seeing a pattern of IPs, but they’re from varying ISPs. They’re also not changing the account emails.\n\n#Mastodon #Password #InfoSec #OpSec #Security #Privacy #Hacked #Hacker",
"sig": "a6fb0516415ac47b5f0f9fd6c7b65312a30e2bd02468e7df4d98045c1624d7e3f03d979c65c37ffefc8c0dadc8169d34fa768199b0f6441712dd18890c6c7f44"
}