A Software Engineer who strongly believes one can add immense value by knowingly implementing Software Engineering best practices, even at the age of AI.
yeah thanks for letting people know. i didn't receive an email but a notification with a list of what im guessing is suspicious names maybe. idk but my account name is on it. i figured the notification about the scam, is the scam itself.
Whether it's an email or an in-app notification, it's the same @mention exploit. They just tagged hundreds of people in one go. If your name is on a massive list of random usernames, it's definitely a phishing attempt. Nice work spotting the suspicious list!
A most commendable piece of work. Thank you for bringing this matter to light and elucidating how even trusted notification systems can be turned against their very users. Such awareness is invaluable in an age where vigilance is paramount. I sincerely appreciate the time and effort you have devoted to sharing these insights. Much obliged for this enlightening read!
Quick update: I got another one today, except this time it actually reached my email instead of just my DEV notifications.
What interests me is that we’re still seeing these mass mentions after yesterday’s posts were taken down. Deleting the posts helps, but it doesn’t necessarily address how they’re reaching people in the first place. I’d be curious whether DEV has any limits on how many unique users an account can mention within a certain time period, rather than just per comment. Otherwise, couldn’t someone simply spread the mentions across multiple comments or accounts?
Seems like that’s the part worth looking into maybe.
This happened to loads of people today, so posts like this really help spread the word. I just hope no one falls for it, especially newer members who might not know DEV would never ask them to log in through a random link.
100%. The scale of this attack was insane. Newer members are prime targets because they haven't built that "spidey sense" for DEV's real emails yet. We just gotta keep reminding everyone that DEV doesn't do shady short links.
A Software Engineer who strongly believes one can add immense value by knowingly implementing Software Engineering best practices, even at the age of AI.
A Software Engineer who strongly believes one can add immense value by knowingly implementing Software Engineering best practices, even at the age of AI.
Freelance fullstack developer creating fast, modern, and refined applications. I focus on simplicity, performance, and real value for users. I also write tech-related articles here.
Woke up to one of those mention notifications myself - thanks for writing this up so quickly to raise awareness.
Weaponizing the platform's legitimate notification pipeline is devious because standard email security checks (DKIM, SPF, sender domain) all pass completely clean. Seeing hundreds of tagged handles paired with an artificial 12-hour deadline and a URL shortener was an instant red flag, but newer members could easily get caught off guard. Strict rate limits on @mentions for newly created accounts and homoglyph filtering on display names definitely need to be prioritized.
Thanks for writing this up quickly. The nastiest part is that the email really does come from DEV, so the usual "check the sender" advice doesn't help. Hiding the skeptical comments is clever too. For anyone who already clicked: change your password, then turn on two-factor in Settings, Account.
Gautam! That's exactly what makes this one so scary. Since the email is a legit notification from DEV's system [email protected] , the usual "check the sender" trick completely fails. Hiding the skeptical comments was a super sneaky move too. And 100% agree on the 2FA advice—if anyone actually typed their password in, changing it and turning on 2FA is the absolute lifesaver here. Thanks for adding that!
Same here, got hit with this mention. It looked believable initially, but asking for card details through a linktr.ee URL gave it away instantly. Hit report right after. Good on you for documenting this so quickly.
Literally this! 💯 Got hit by a couple of these random notification pings recently and was super confused. Glad you called it out and raised awareness. Dev.to really needs to patch this vector ASAP.
Implementation Specialist and Database Developer with over 15 years of experience in the IT industry, specializing in the design, implementation and management of relational databases.
Hi, there are no fake login page or sso for GitHub, the page goes to website similarly same with dev.to, but asking for cc details.
and then I remember, it's all about timing, the challenges are end, and it's big opportunity for them because we aware the winning prize, and money calls money.
IMHO
We're a place where coders share, stay up-to-date and grow their careers.
Thank you Jack for announcing this.
<3 its my pleasure Boss Francis!
Come on! You guys are DEVs. Let's join forces and spam the spammer 🤣
already check back the post are deleted ;p~ fast hand thooo; well its on 2 posts too.
i was gonna send the cc's info, but i suddenly remember,.... i dont have cc! elqfrin doesnt help either! :p
Yep got two notifications. One post was gone when I checked it. The other was up then , I flagged it. Sure many others did as well. It is gone now.
Nobody should be able to mention 100+ users. no need for that.
yeah thanks for letting people know. i didn't receive an email but a notification with a list of what im guessing is suspicious names maybe. idk but my account name is on it. i figured the notification about the scam, is the scam itself.
Whether it's an email or an in-app notification, it's the same @mention exploit. They just tagged hundreds of people in one go. If your name is on a massive list of random usernames, it's definitely a phishing attempt. Nice work spotting the suspicious list!
The mass tagging is already a red flag, but impersonating DEV support is an even bigger one.
A most commendable piece of work. Thank you for bringing this matter to light and elucidating how even trusted notification systems can be turned against their very users. Such awareness is invaluable in an age where vigilance is paramount. I sincerely appreciate the time and effort you have devoted to sharing these insights. Much obliged for this enlightening read!
Quick update: I got another one today, except this time it actually reached my email instead of just my DEV notifications.
What interests me is that we’re still seeing these mass mentions after yesterday’s posts were taken down. Deleting the posts helps, but it doesn’t necessarily address how they’re reaching people in the first place. I’d be curious whether DEV has any limits on how many unique users an account can mention within a certain time period, rather than just per comment. Otherwise, couldn’t someone simply spread the mentions across multiple comments or accounts?
Seems like that’s the part worth looking into maybe.
I've reaching out creating issue on GitHub to help in forem, and we have same celebral vibes in here.
This happened to loads of people today, so posts like this really help spread the word. I just hope no one falls for it, especially newer members who might not know DEV would never ask them to log in through a random link.
100%. The scale of this attack was insane. Newer members are prime targets because they haven't built that "spidey sense" for DEV's real emails yet. We just gotta keep reminding everyone that DEV doesn't do shady short links.
This one isn't asking for password though. This one is asking for Credit Card info.
Don't worry, I've checked it using a safe environment 🤣
Woke up to one of those mention notifications myself - thanks for writing this up so quickly to raise awareness.
Weaponizing the platform's legitimate notification pipeline is devious because standard email security checks (DKIM, SPF, sender domain) all pass completely clean. Seeing hundreds of tagged handles paired with an artificial 12-hour deadline and a URL shortener was an instant red flag, but newer members could easily get caught off guard. Strict rate limits on
@mentionsfor newly created accounts and homoglyph filtering on display names definitely need to be prioritized.Highlighted this before
dev.to/rudratosh/the-fake-dev-supp...
Thanks for writing this up quickly. The nastiest part is that the email really does come from DEV, so the usual "check the sender" advice doesn't help. Hiding the skeptical comments is clever too. For anyone who already clicked: change your password, then turn on two-factor in Settings, Account.
Gautam! That's exactly what makes this one so scary. Since the email is a legit notification from DEV's system
[email protected], the usual "check the sender" trick completely fails. Hiding the skeptical comments was a super sneaky move too. And 100% agree on the 2FA advice—if anyone actually typed their password in, changing it and turning on 2FA is the absolute lifesaver here. Thanks for adding that!Same here, got hit with this mention. It looked believable initially, but asking for card details through a linktr.ee URL gave it away instantly. Hit report right after. Good on you for documenting this so quickly.
Literally this! 💯 Got hit by a couple of these random notification pings recently and was super confused. Glad you called it out and raised awareness. Dev.to really needs to patch this vector ASAP.
Hi Jack, did the fake login page also offer GitHub SSO, or just steal passwords?
Hi, there are no fake login page or sso for GitHub, the page goes to website similarly same with dev.to, but asking for cc details.
and then I remember, it's all about timing, the challenges are end, and it's big opportunity for them because we aware the winning prize, and money calls money.
IMHO