Reddit’s Phishing Breach: When MFA Codes Get Phished Too

Quick Answer — On February 9, 2023, Reddit disclosed that a phishing campaign had tricked an employee into entering credentials and an MFA code on a fake intranet page, giving an attacker 6–7 hours of internal access: docs, dashboards, some contact info, plus limited advertising data — and later claims of source-code access. No evidence pointed to user account credentials being exposed; the boundary that failed was phishable MFA, and the control that capped the damage was the employee’s fast self-report. The lesson: credentials plus an OTP are not a boundary; phishing-resistant factors and reporters-are-heroes culture are.

What happened

• The lure (Feb 5): Employees received plausible fake-intranet prompts pointing at a cloned Reddit SSO page. One employee entered username, password, and the one-time code from their MFA device — the same credential-plus-OTP chain that real-time phishing relay kits have monetized for years.
• The access: Attacker used the creds + phished OTP tokens to reach internal systems for a few hours on the same day, pulling documents/dashboards and limited advertiser data.
• The save: The same employee self-reported being phished — Reddit locked it down fast, and the incident’s damage stayed measured-bounded rather than estate-wide.
• The extortion follow-up: In a June 2023 twist, an actor demanded payment and Reddit said no; per the actor’s own claims, ~80GB of internal docs and source material then got posted as leverage.

Why this phish worked when “we have MFA”

Timeline

The June extortion follow-on

Four months after the February disclosure, the actor publicly demanded a payout and threatened publication; Reddit refused, and claimed internal material — including source-code claims — was then posted. The February assessment of scope was reiterated. For response teams, this is the standard arc when stolen internal data outlives containment: disclose early, scope honestly, refuse payment, and pre-draft comms for the eventual leak drop.

Defensive lessons

• Phishable MFA is a speed bump, not a wall. TOTP codes and push prompts can be phished/relayed in real time; FIDO2/WebAuthn passkeys with origin binding break the relay because the token refuses to sign for the wrong domain.
• Fast reporters are your cheapest IR. The harmed scope was hours not days because the phished employee came forward; training that celebrates (not punishes) reports pays compounding dividends.
• Assume docs estates leak. Internal wikis/dashboards metadata (emails, advertiser contacts) don’t need SSN-grade data to hurt — business relationships get targeted by the leak’s readers.
• Plan the extortion follow-on. Data from “contained” breaches returns with a price tag months later; response comms should preview that possibility early.
• Token-binding wherever possible. Session hardening (token protection tying sessions to devices) mutes what a phisher’s minted session can reach.

Why it still matters in 2026

The Reddit phish became a canonical “MFA is not MFA” teaching case in the same season as the Uber MFA-fatigue hit and a run of high-profile adversary-in-the-middle campaigns. It accelerated the industry’s passkey migration logic — FIDO2’s origin-binding is precisely the property whose absence let this chain complete — and normalized self-report-positive culture as a measurable control. In 2026’s landscape (AI-assisted phishing at craft-union quality, OTP-relay kits commoditized), the case reads even starker: any factor a human can be talked into relaying is a factor an attacker owns. The fix was never more secrecy; it was math the user can’t be socially engineered into surrendering.

Was user account data stolen?

Reddit’s statements said no evidence indicated exposure of user account credentials, primary account data beyond limited contact metadata, or private-message content. What leaked per the actor’s June claims: internal documents, dashboards, some contact info, limited advertising data, and claimed source-code material — squarely an internal-data incident.

What’s adversary-in-the-middle phishing?

A phishing pattern where the fake page acts as a live proxy: the victim “logs in” to the attacker’s mirror, which forwards credentials and the OTP to the real site in real time, captures the minted session token, and then discards the victim. It defeats traditional OTP MFA entirely — the code was valid, just consumed by the wrong party. Passkeys defeat the relay because the client cryptographically checks the origin before authenticating.

What happened after the June leak demand?

Reddit publicly refused payment; the actor posted the material. The company reiterated its February assessment of scope. For defenders, the sequence is the standard no-pay playbook: disclose early, scope honestly, refuse quietly, prepare for the drop.

Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.

Detection and response playbook

Reddit-style breaches — one employee, one convincingly cloned portal, MFA satisfied — are won or lost in the hours after the initial compromise. Here is the sequence an IR team should run when a similar phishing alert fires, drawn from how this incident actually unfolded.

1. Treat any MFA “success” from a new device or ASN as suspicious, not reassuring. Adversary-in-the-middle kits relay the real prompt, so the authentication log looks legitimate. Pivot to device posture and impossible-travel signals instead of the MFA event itself.
2. Hunt for the token, not the password. The intruder’s prize was the authenticated session cookie. Search EDR telemetry for browser process memory dumps, unusual localStorage access by non-browser processes, and new user agents appearing on existing refresh-token grants.
3. Revoke and rotate all OAuth grants for the affected identity immediately. Password resets alone accomplish nothing when the session survives them — the June extortion follow-on demonstrated how long a foothold can quietly persist.
4. Scope the internal document access. Pull data-access logs for the compromised identity for the full dwell window and diff against their normal baseline. The Stealc infostealer staged exfiltration quickly; the gap between first access and detection is what determines the blast radius you disclose.
5. Prepare the extortion scenario before it happens. Assume stolen internal material will resurface in a ransom note months later. Pre-draft holding statements and legal privilege paths now; June 2023 showed the second act arrives when the news cycle has moved on.

A useful Sigma-style starting point: alert on authentication success events where device_id is unseen in 30 days and the user agent string contains headless-browser markers or known AITM proxy fingerprints. It is a noisy rule on its own; combined with a phish-report from the same user, it is a high-confidence intrusion signal.

For defenders, the uncomfortable summary of this incident: every control that failed was a control that assumed the employee was the sensor. The employee did report — after interacting with the page. Engineering must assume the report arrives post-compromise and optimize for what happens in the next sixty minutes, not for preventing the click entirely.

Where this sits in the broader pattern

Reddit’s breach was not an outlier; it was a genre. The same adversary-in-the-middle phishing kit lineage and the same relay-the-MFA-prompt logic drove the 2022 Twilio and Cloudflare incidents, the Uber breach of the same year, and the Lapsus$ intrusions at Microsoft and Okta. Cloudflare’s postmortem is the canonical comparison: identical initial technique, radically different outcome, because their hardware-key-holding employees could not be phished at all. The differential is not budget — it is authentication architecture.

The June 2023 extortion follow-on also fits a pattern: BlackCat/ALPHV had already run the pay-or-we-publish playbook against Reddit contemporaries in gaming and telecom. Expect the second act. The organizations that handle these well pre-decide the answer to one question: what will we never pay, and what will we say on day one when the answer is tested?

Read alongside our other incident breakdowns — Uber and the MFA-fatigue era, Lapsus$ and help-desk social engineering, and the combo-list economy that feeds initial access — the conclusion is repetitive on purpose: phishing-resistant MFA, session hygiene, and a rehearsed extortion response cover the majority of this entire attack family with three controls.

The bottom line. One employee, one cloned portal, one relayed MFA prompt — and a months-long tail of extortion. Every defensive dollar this incident argues for spends on three things: phishing-resistant authentication that makes the relay structurally impossible, session controls that make a stolen login short-lived, and an extortion playbook written before the ransom note arrives. The organizations that walk into 2026 with those three controls deployed read stories like this as history; the ones without them are still writing the same story with the dates changed. The technology to end this attack class exists, is cheap relative to the alternative, and is finally easy to deploy. What remains scarce is the decision.

One question deserves a permanent place on the quarterly security review agenda: if a reporter called tomorrow with proof that an internal system was compromised six months ago, what would we wish we had logged, rotated, or rehearsed today? Incidents like this one are only survivable in retrospect when the answers already exist. The alternative is improvising under deadline with an attacker holding the pen — which is precisely the position Reddit found itself in when the extortion note arrived in June, and precisely the position every organization without a rehearsed playbook is in right now, silently, without knowing it yet.

Frequently Asked Questions

{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”How did attackers bypass MFA in the Reddit breach?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”They used an adversary-in-the-middle phishing kit that proxied the real Reddit login page, capturing credentials and relaying the genuine MFA prompt. The employee approved a legitimate-looking prompt, handing over the authenticated session.”}},{“@type”:”Question”,”name”:”What was stolen in the Reddit February 2023 breach?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Internal documents, dashboards, and source code, taken using stolen employee credentials and session tokens. No user passwords or accounts were compromised.”}},{“@type”:”Question”,”name”:”What is the best defense against MFA-relay phishing?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Phishing-resistant authentication (FIDO2 passkeys or hardware keys) bound to origin, plus session-anomaly detection and rapid OAuth grant revocation when a phish is reported.”}}]}

Related Reading

• What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
• Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
• 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
• Authoritative reference: CISA Known Exploited Vulnerabilities

More on this topic

• Twitter’s 5.4M Scrape: When an API Becomes a Breach Oracle
• Okta’s Weak Link: When Your IdP’s Vendor Gets Pwned
• When Hackers Hunted the WHO: Cyberattacks in a Pandemic’s First

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy