This morning I did receive five (5) notification of services created on my behalf using GitHub-related (and #discord) email accounts:
- Canary Mail
- Angel Studios
- Quora
- Branded
- Cardi.Health
- (new since posted)
- Replika
- VSCO
- Medium
- Headspace
- Commuinity.com
- Survive the ARK
- Jimdo
- Dropbox
I'm still not sure if this still an issue with the last #zendesk breach or an ongoing #GitHub one.
@esparta I'm on 35 of these and counting
@davetron5000 all of them today, or accumulated?
I've notice that this is happening with #discord-related email, so it's possible all of them: #github, #zendesk, #discord ?
Do you notice some pattern?
@esparta All today within a few hour period. I've noticed both my gmail address and then my gmail address with random characters after a +. The sites are just all over the place as to what they are.
@davetron5000 thanks!
you made me look in my old gmail account, and that's correct: a couple of registrations with `$myhandle+$SOME_CHARS@gmail.com`
- Medium
- HeadSpace
the only pattern now still #github + #zendesk
I'm still scratching my head about the why? Do they try to DDoS their registration systems?
@esparta Could be related to this: https://www.bleepingcomputer.com/news/security/zendesk-ticket-systems-hijacked-in-massive-global-spam-wave/
Thought I'm not sure what the endgame would be?
@davetron5000 yeap, that's what I meant in OP, the breach was real and people got SPAM, back in those day I received zero SPAM messages.
This is kind of new, it's a legit registration, no fake domains, all emails for real. A _clean_ automation. It's an annoying situation but inconsequential.
My guessing about endgame: make #zendesk know their bases belongs to whoever hacked them.
My second guess is this a very low scale, and we are not important enough so the media don't pick this issue up
