Bad actors are abusing large, open-registration, low-moderation Mastodon instances in order to provide direction to the Vidar Stealer trojan horse, which steals passwords, credit card details, bitcoin wallets, etc.

If you run a large, open-registration, low-moderation instance, please consider changing at least one of those qualities.

To add additional clarity on how this works:

1) Bad actor sets up Mastodon accounts with the IP of the site the trojan horse should use to get its data, assuming that because of open registration and nobody regularly reviewing new accounts that don't post objectionable content, they won't get kicked off.
2) Bad actor sets up their copy of the Vidar Stealer trojan to track those Mastodon accounts.
3) Bad actor tries to trick people into installing their trojan horse with the usual tricks (fake download sites, attachments in emails, etc.)
4) The trojan horse looks at those Mastodon accounts to get the IP address it should check to download its payload.

Mastodon itself is not a delivery vector for this trojan horse; the accounts simply exist to provide a trusted source for information for an already-infected computer. You do not have to worry about getting a virus from Mastodon!

Show thread
Sign in to participate in the conversation
Disk Seven (Social)

The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!