A stranger appears

A highly unusual person joined Lemdit yesterday and proceeded to make a post in Lemdit Official. It consisted of a long list of links and some random anime image.

He styled himself Maskugatiger a.k.a Cybernetwalker. (The Highest Leader of Global Civil Society Community)

I initially thought it was some kind of bizarre spam bot, but curiosity got the better of me and I decided to go down the rabbit hole.

The rabbit hole runs deep

The first handful of links were to various obscure boards and pages that this individual had created. They were all very strange:

• The forums had countless sections that were seemingly empty.
• There were animated gifs, k pop idols and random anime images plastered everywhere.
• Lots and lots of buttons and random links in all kinds of colors.
• There were long ramblings that mixed Islamic fundamentalist views, doomsday prepper advice, death cult beliefs, calls for revolution, a love for childish

It looks like lemmy.world has been hacked.

The instance has been defaced, the site is only intermittently accessible, sometimes it redirects to a random video or other nasty URLs

DO NOT ATTEMPT TO LOG INTO LEMMY.WORLD UNTIL THIS IS CLEARED UP AND OFFICIAL ANNOUNCEMENTS ARE MADE BY ITS ADMIN.

My recommendation is to stay away entirely for the time being and monitor this thread for updates: https://lemmy.ml/post/1895271 (https://lemdit.com/post/44963)

Update:

• It looks like this was caused by a compromised Admin account
• It may be attributed to an exploit introduced by a specific git commit that lemmy.world was using (not public).

Initial indications are that this was particular to lemmy.world and not a symptom of wider Lemmy vulnerabilities.

The short of it is:

• vlemmy.net was one of the larger Lemmy instances (>10k users)
• They suddenly went offline today with no warning, all DNS records gone
• Nobody really knows why

There's more discussion in this thread: https://feddit.nl/post/458654

From what I can tell, this has nothing to do with their domain expiring / them forgetting to pay their domain bill. WHOIS records show it had been registered for many years, and domain registration is paid for in advance:

The domain status appears to have changed. The June 10th 2023 WHOIS data showed it as:

The status now is:

Something is clearly

Today I received this text message:

• Opening the URL from a desktop computer redirects to the real NZ Post website.
• Opening the URL from mobile shows a convincing spoofed NZ Post tracking page:

The objective of the scam is to get you to click on "Schedule a Redelivery" and give them your personal details:

They will use this information to contact you and attempt to scam money from you, as well as try any future scams they may come up with.

The combination of URL + believable phishing page makes this scam particularly easy to fall for. If you're from NZ, then it's a good idea to warn your friends and family about it.

I will report the domain but it usually takes a very long time for anything to be done in these cases.

An international recruitment company (indeed)

This particular scam seems to be getting more refined, similar messages I received in the past were from obviously hijacked accounts belonging to randoms and had worse english.

For the record, I'm not, nor have I ever been looking for part-time work online. I guess my number is on some sort of list that gets sold and re-sold, so I get to enjoy all the latest scam attempts.

I look forward to the inevitable catfish attempt that usually follows a few days later.

Snapped on my way home the other day.