spammers hijacking accounts

[j.p.s]

Originally Posted by ownedbycats

This is the second or third time in the last few days I've had to report a spam post by an inactive, but previously legitimate, account here on MR. What is going on?

Originally Posted by pdurrant

I would guess that the user had accounts using the same username and password on multiple sites, and a spammer has got hold of a list of usernames and passwords from one of the many security breaches, and is just trying them on as many services as possible until they find one that works. Which will usually be an inactive account.

Originally Posted by j.p.s

It looks to me like the hijacked accounts have all had ICQ, AIM, and Yahoo contact icons, but maybe the spammer added those.

I haven't kept a list of the hijacked accounts from the last couple of days, but I looked at the page for the currently most recent one after the spam had been deleted. The home page and "contact me" page for that user had the spammer's website and IM info. The same had been true of the few I looked at earlier today before the spam deletion. I guess web crawlers might not find anything for the users that didn't make any posts, but I think some of the hijacked accounts did have a posting history, and that any threads with those posts that get crawled will contain the spam website, etc.

The thread titles imply the hawking of pumping tools, so maybe the SEC and even the FBI would be interested. (Or a group of forum sites getting hit could get the web site and IM accounts shut down.)

[Karellen]

This is not the only forum with that issue. The Kodi website is getting the same "pumping tools" spam. Some from long term members who have had their accounts compromised.

[ownedbycats]

Just reported another one. Sigh...

EDIT: And another! Damn.

EDIT: This is getting ridiculous...