If you received an email today saying "Mandatory user verification" with a 12-hour deadline, DO NOT CLICK THE LINK.
I woke up to an email notification from DEV.to stating that a user named ๐ฟ๐๐ซ ๐๐ช๐ฅ๐ฅ๐ค๐ง๐ฉ ๐๐๐๐ข had mentioned me in a comment. Upon opening the post, I found a massive phishing campaign that has successfully infected the platform.
Here is a complete technical breakdown of how this scam works, why you received the email, and what you should do.
๐ฉ The Anatomy of the Attack
1. The Fake Post & Account
The scammer creates a post titled "Mandatory user verification". The author's name uses Unicode characters (๐ฟ๐๐ซ ๐๐ช๐ฅ๐ฅ๐ค๐ง๐ฉ ๐๐๐๐ข) to bypass text filters and look like an official DEV admin. The account itself is a bot (e.g., @gfdgfsgfdsgf).
2. Abuse of the Mention System
You didn't receive a direct email from the hacker. You received an automated notification from DEV.to because the hacker spammed @mentions of hundreds of users in the comments. The platform's legitimate email system was weaponized to deliver the threat directly to your inbox.
3. The Malicious Link
The post instructs you to log in via a third-party URL shortener: tr.ee/dev-to.
RED FLAG: DEV.to will never use a URL shortener for authentication. If you click it, you are redirected to a pixel-perfect clone of the DEV.to login page designed to steal your credentials (Phishing).
4. Psychological Triggers
The post uses classic social engineering tactics: artificial urgency ("12 hours deadline") and fear ("Failure to verify will result in restricted access") to make you act before you think.
5. Hiding the Evidence
The bot spams comments to bury the post. If you look at the comments, legitimate users asking "Is this real?" have their comments hidden by the post author so other users won't see the skepticism.
๐ก๏ธ How to Protect Yourself
-
Never use URL shorteners for Auth: If an email asks you to click a
bit.ly,tr.ee, ortinyurllink to log in, it's a scam. -
Check the URL: The official domain is
dev.to. Always verify the root domain before entering your password. - Don't Panic: DEV.to will never threaten to delete your account within 12 hours without a prior warning.
- Report & Block: Use the DEV.to "Report Abuse" button on the post.
๐ง What DEV.to Needs to Fix (For the DEV Team)
While the community stays vigilant, this incident highlights some critical infrastructure vulnerabilities:
- Rate Limiting on Mentions: New accounts should not be allowed to mention 100+ users in a single comment.
-
Unicode Homograph Protection: Names using mathematical alphanumeric symbols (
๐ฟ๐๐ซ) should be flagged or normalized to prevent impersonation. - Email Sanitization: Perhaps DEV.to could include an automated warning banner in mention-notification emails if the parent post is flagged by the community.
Stay safe out there, developers. Never let an API or a bot rush you into giving up your credentials.
Have you received this email too? Let me know in the comments below (if they are visible ๐).
Ping : @devteam @ben
Top comments (7)
i was gonna send the cc's info, but i suddenly remember,.... i dont have cc! elqfrin doesnt help either! :p
This happened to loads of people today, so posts like this really help spread the word. I just hope no one falls for it, especially newer members who might not know DEV would never ask them to log in through a random link.
100%. The scale of this attack was insane. Newer members are prime targets because they haven't built that "spidey sense" for DEV's real emails yet. We just gotta keep reminding everyone that DEV doesn't do shady short links.
yeah thanks for letting people know. i didn't receive an email but a notification with a list of what im guessing is suspicious names maybe. idk but my account name is on it. i figured the notification about the scam, is the scam itself.
Whether it's an email or an in-app notification, it's the same @mention exploit. They just tagged hundreds of people in one go. If your name is on a massive list of random usernames, it's definitely a phishing attempt. Nice work spotting the suspicious list!
Thanks for writing this up quickly. The nastiest part is that the email really does come from DEV, so the usual "check the sender" advice doesn't help. Hiding the skeptical comments is clever too. For anyone who already clicked: change your password, then turn on two-factor in Settings, Account.
Gautam! That's exactly what makes this one so scary. Since the email is a legit notification from DEV's system
yo@dev.to, the usual "check the sender" trick completely fails. Hiding the skeptical comments was a super sneaky move too. And 100% agree on the 2FA adviceโif anyone actually typed their password in, changing it and turning on 2FA is the absolute lifesaver here. Thanks for adding that!