oh shit... They really did brute force it. I'm looking at attempts to sign into my account and it's like 20 per day for the past month. All from "different" countries. - ThreadSky

werewhisky.bsky.social • 1 day ago

oh shit... They really did brute force it. I'm looking at attempts to sign into my account and it's like 20 per day for the past month. All from "different" countries.

Reposted from Werewhisky🔜TFF

fucking hell someone brute forced my Microsoft account last night. IP was from Brazil and then jumped to UK.

Thankfully I logged em out and changed my password but like... what the fuck? I have 2-step verification for a reason? Why didn't it go off?

Checked my emails and they have no sign-ins so??

Comments

werewhisky.bsky.social•1 day ago

Yeah so I've had 2 more attempts on my account since securing it.

I love that there's nothing else I can do about this other than just wait until their botnet gets shut down.

otter.is•1 day ago

I guess it’s time to change my password just to be safe. It’s really long and randomly generated but better safe than sorry. It seriously skeeves me out to hear that 2FA was somehow bypassed in your case. I suggest checking your email settings and make sure they didn’t plant a forwarding address.

baerbeast.bsky.social•1 day ago

damn you caught me before I got everything

thatdogdamien.bsky.social•1 day ago

This happened to me recently too >-> scary stuff but hopefully the refreshed security settings keep em out

argakyan.bsky.social•1 day ago

They haven't broken through yet, but somebody has tried it literally for as long back as Microsoft tracks attempts at logging in for my account. I got 2-factor and all that, but it's very annoying that there's no option to restrict country or IP.

gooeygator.bsky.social•1 day ago

Good reminder to have a password manager. Automatic, high security passwords that are nearly impossible to brute force.

hyenatron.bsky.social•1 day ago

It takes a lot to secure a Microsoft account because of how many ways in they have. You’ve also got to make sure you have application specific passwords on, do NOT use SMS two factor, and preferably remove your password in favor of Authenticator.

sootsky.bsky.social•1 day ago

But you have 2 factor??

werewhisky.bsky.social•1 day ago

Through my email, but now through both email and an app.

I checked to see if my email was compromised and it's not, and even if it was, I have a backup security email just in case.

But yeah, didn't get notified until they breached. Really fucking annoying.

bazthetiger.bsky.social•1 day ago

Holy crap. I would suggest changing the 2 factor to something stronger

werewhisky.bsky.social•1 day ago

Yeah I just locked it down. Still though Im like... I hope whoever it was who doing this spontaneously combusts. I hate dealing with this shit. @.@

furryforestcritter.bsky.social•1 day ago

I'm seeing that myself. There must be a new wave of attempts out there by a group who probably bulk bought information. Sounds like you took the correct measures to take care of it but it's scary. Hopefully these kinds of things can be cracked down on.

furryforestcritter.bsky.social•1 day ago

Granted, I know given the state of the world that's a big ask but. Really do hope...

Comments

Posting Rules

Reply