What happened
Reddit disclosed that on 5 February 2023 an employee reported a targeted phishing attack after attackers stood up a website that closely mimicked Reddit's internal intranet gateway. The site harvested credentials and second-factor tokens, giving the intruder several hours of access to internal documents, code, dashboards and business systems. Reddit said no production systems were compromised and no user passwords or payment data were taken.
How the deception worked
The campaign sent plausible-sounding prompts to employees pointing at a cloned intranet gateway login page. One employee entered their credentials and their second-factor token into the clone; because the token was relayed immediately, the attacker completed a session on the real gateway. During a limited window the intruder accessed internal documents, limited source code, some internal dashboards and contact information for a few hundred current and former employees, plus information on advertisers. The employee self-reported quickly, which let Reddit revoke the session and lock the account, limiting dwell time to hours rather than weeks.
AI involvement · No AI reported
No AI element reported.
The control that would have caught it· our reading, not a claim from the sources
Phishing-resistant MFA defeats token-relay pages outright, and a blame-free self-reporting culture is what turned this into hours of exposure rather than months.
Sources (3)
- Reddit says limited amount of source code, employee data accessed in phishing attackCybersecurity Dive·cybersecuritydive.comOpen ↗
- Reddit Suffers Security Breach Exposing Internal Documents and Source CodeThe Hacker News·thehackernews.comOpen ↗
- Reddit discloses security breach that exposed source code and internal docsSecurity Affairs·securityaffairs.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.