2 ms·

This smells like session hijack rather than a straight password/2FA bypass. If an attacker stole a valid cookie (phishing page, malicious extension, or compromi

This smells like session hijack rather than a straight password/2FA bypass. If an attacker stole a valid cookie (phishing page, malicious extension, or compromised machine), they can ride your session without hitting the 2FA gate. The US IPs plus sudden content spam fits that pattern. The pragmatic checklist I’d run: log out all devices, rotate password and 2FA, switch to a hardware key/WebAuthn, audit browser extensions (disable anything non‑essential), scan the box, and revoke any third‑party app access tied to Reddit. On the policy side, keep a clear timeline of IPs and actions; in my experience, a concise paper trail sometimes gets a human review even when the first appeal doesn’t. Glad the account is back—hopefully it sticks.

guilamu 1y ago
Hello, thank you very much for your very insightful comment! The cookie theft is also IMHO the most probable scenario. The malicious extension is the only thing that make sense to me. log out all devices: done rotate password and 2FA: done switch to a hardware key/WebAuthn: not done yet audit browser extensions: done (I'm using only what I think are very "secure" ones: Bypass Paywalls Clean, Control Panel for Twitter , Correcteur d'orthographe et reformulateur — LanguageTool , Google Images Restored, I still don't care about cookies, Keepa - Amazon Price Tracker, Reddit Enhancement Suite, SingleFile , uBlock Origin , Voir image (https://github.com/bijij/ViewImage https://github.com/bijij/ViewImage) scan the box: done revoke any third‑party app access tied to Reddit: there are none Anyhow, thank again!
- gnyman 1y ago
  Even if none of these extensions were malicious, they might have some vulnerability that would allow and attacker to get your cookie? Or the developers of those might have unknowingly been phished like what happened last December. Sorry for just offering speculation, hopefully you figure it out. Even if it was "only" a Reddit account, the feeling of not knowing how it happened and if other things are at risk must be horrible. https://crxplorer.com/ https://crxplorer.com/ might help you to inspect your extensions a bit deeper if you are interested and have the knowledge. And finally, just a comment, passkeys/webauthn/fido keys would not protect against a session cookie theft. They only prevent the login stage from being phished.
  - guilamu 1y ago
    Thanks again for your input! I'll look into crxplorer.
  - guilamu 1y ago
    I've just had my Amazon account hacked with an order of a gift card. I saw it immediately so I was able to request a refund, change passwords, add 2fa, remove any payment info. This is probably linked, I still don't understand how this is possible...
mcintyre1994 1y ago
Not foolproof, but I wonder why sessions aren’t linked to an IP to prevent this.

guilamu 1y ago

Hello, thank you very much for your very insightful comment! The cookie theft is also IMHO the most probable scenario. The malicious extension is the only thing that make sense to me. log out all devices: done rotate password and 2FA: done switch to a hardware key/WebAuthn: not done yet audit browser extensions: done (I'm using only what I think are very "secure" ones: Bypass Paywalls Clean, Control Panel for Twitter , Correcteur d'orthographe et reformulateur — LanguageTool , Google Images Restored, I still don't care about cookies, Keepa - Amazon Price Tracker, Reddit Enhancement Suite, SingleFile , uBlock Origin , Voir image (https://github.com/bijij/ViewImage https://github.com/bijij/ViewImage) scan the box: done revoke any third‑party app access tied to Reddit: there are none Anyhow, thank again!

gnyman 1y ago
Even if none of these extensions were malicious, they might have some vulnerability that would allow and attacker to get your cookie? Or the developers of those might have unknowingly been phished like what happened last December. Sorry for just offering speculation, hopefully you figure it out. Even if it was "only" a Reddit account, the feeling of not knowing how it happened and if other things are at risk must be horrible. https://crxplorer.com/ https://crxplorer.com/ might help you to inspect your extensions a bit deeper if you are interested and have the knowledge. And finally, just a comment, passkeys/webauthn/fido keys would not protect against a session cookie theft. They only prevent the login stage from being phished.
- guilamu 1y ago
  Thanks again for your input! I'll look into crxplorer.
- guilamu 1y ago
  I've just had my Amazon account hacked with an order of a gift card. I saw it immediately so I was able to request a refund, change passwords, add 2fa, remove any payment info. This is probably linked, I still don't understand how this is possible...

mcintyre1994 1y ago

Not foolproof, but I wonder why sessions aren’t linked to an IP to prevent this.