How Hackers Weaponized DEV.to's Mention System to Spread a Phishing Scam

If you received an email today saying "Mandatory user verification" with a 12-hour deadline, DO NOT CLICK THE LINK.

I woke up to an email notification from DEV.to stating that a user named 𝘿𝙚𝙫 𝙎𝙪𝙥𝙥𝙤𝙧𝙩 𝙏𝙚𝙖𝙢 had mentioned me in a comment. Upon opening the post, I found a massive phishing campaign that has successfully infected the platform.

Here is a complete technical breakdown of how this scam works, why you received the email, and what you should do.

🚩 The Anatomy of the Attack

1. The Fake Post & Account
The scammer creates a post titled "Mandatory user verification". The author's name uses Unicode characters (𝘿𝙚𝙫 𝙎𝙪𝙥𝙥𝙤𝙧𝙩 𝙏𝙚𝙖𝙢) to bypass text filters and look like an official DEV admin. The account itself is a bot (e.g., @gfdgfsgfdsgf).

2. Abuse of the Mention System
You didn't receive a direct email from the hacker. You received an automated notification from DEV.to because the hacker spammed @mentions of hundreds of users in the comments. The platform's legitimate email system was weaponized to deliver the threat directly to your inbox.

3. The Malicious Link
The post instructs you to log in via a third-party URL shortener: tr.ee/dev-to.
RED FLAG: DEV.to will never use a URL shortener for authentication. If you click it, you are redirected to a pixel-perfect clone of the DEV.to login page designed to steal your credentials (Phishing).

4. Psychological Triggers
The post uses classic social engineering tactics: artificial urgency ("12 hours deadline") and fear ("Failure to verify will result in restricted access") to make you act before you think.

5. Hiding the Evidence
The bot spams comments to bury the post. If you look at the comments, legitimate users asking "Is this real?" have their comments hidden by the post author so other users won't see the skepticism.

🛡️ How to Protect Yourself

• Never use URL shorteners for Auth: If an email asks you to click a bit.ly, tr.ee, or tinyurl link to log in, it's a scam.
• Check the URL: The official domain is dev.to. Always verify the root domain before entering your password.
• Don't Panic: DEV.to will never threaten to delete your account within 12 hours without a prior warning.
• Report & Block: Use the DEV.to "Report Abuse" button on the post.

🔧 What DEV.to Needs to Fix (For the DEV Team)

While the community stays vigilant, this incident highlights some critical infrastructure vulnerabilities:

1. Rate Limiting on Mentions: New accounts should not be allowed to mention 100+ users in a single comment.
2. Unicode Homograph Protection: Names using mathematical alphanumeric symbols (𝘿𝙚𝙫) should be flagged or normalized to prevent impersonation.
3. Email Sanitization: Perhaps DEV.to could include an automated warning banner in mention-notification emails if the parent post is flagged by the community.

Stay safe out there, developers. Never let an API or a bot rush you into giving up your credentials.

Have you received this email too? Let me know in the comments below (if they are visible 👀).

Ping : @devteam @ben