At Yahoo! there's a dedicated security team that handled identifying the exact cause and worked with us to resolve it. To identify compromised accounts we look

At Yahoo! there's a dedicated security team that handled identifying the exact cause and worked with us to resolve it. To identify compromised accounts we looked for profile photos matching a certain md5. The attackers were using the accounts for viagra links and updated compromised account profile photos with one of about 50 photos. Once we identified the accounts they were "quarantined". But the attackers got smart and started shifting a pixel so that the md5 wouldn't match our set of known bad photos. There were other patterns we identified to isolate the compromised accounts but it was ongoing which meant as we cleaned up accounts the attackers adapted. For the 3M accounts a bit was flipped in their account. The membership team which handles logins handled the first step of the compromised user signing in. They redirected the user to a specific page that took them through a password reset flow. It wasn't the standard password reset flow. After all, we couldn't know if it was the attacker or the user logging in. This was all a while back but it was more or less something along those lines. It was not fun.