Quick Answer — On February 9, 2023, Reddit disclosed that a phishing campaign had tricked an employee into entering credentials and an MFA code on a fake intranet page, giving an attacker 6–7 hours of internal access: docs, dashboards, some contact info, plus limited advertising data — and later claims of source-code access. No evidence pointed to user account credentials being exposed; the boundary that failed was phishable MFA, and the control that capped the damage was the employee’s fast self-report. The lesson: credentials plus an OTP are not a boundary; phishing-resistant factors and reporters-are-heroes culture are.
What happened
- The lure (Feb 5): Employees received plausible fake-intranet prompts pointing at a cloned Reddit SSO page. One employee entered username, password, and the one-time code from their MFA device — the same credential-plus-OTP chain that real-time phishing relay kits have monetized for years.
- The access: Attacker used the creds + phished OTP tokens to reach internal systems for a few hours on the same day, pulling documents/dashboards and limited advertiser data.
- The save: The same employee self-reported being phished — Reddit locked it down fast, and the incident’s damage stayed measured-bounded rather than estate-wide.
- The extortion follow-up: In a June 2023 twist, an actor demanded payment and Reddit said no; per the actor’s own claims, ~80GB of internal docs and source material then got posted as leverage.
Why this phish worked when “we have MFA”
| Layer | What happened |
|---|---|
| Password | Entered by victim on attacker’s page — harvested |
| MFA (OTP) | Phished in real time — code entered by victim on the attacker’s live fake page |
| Conditional access | Session token minted from the phished context; device-trust gaps let it ride |
| People | Self-report within hours — the control that actually capped the damage |
Timeline
| Date | Event |
|---|---|
| 2023-02-05 | Phishing wave against employees (cloned intranet prompts) |
| 2023-02-05 (same day) | One employee phished; ~6–7 hours of internal access |
| 2023-02-09 | Reddit’s disclosure post: exposure detailed; “no evidence” of the taken data including user passwords/accounts |
| 2023-06 | Extortion attempt; no payment; leak of claimed material (incl. source-code claims) |
The June extortion follow-on
Four months after the February disclosure, the actor publicly demanded a payout and threatened publication; Reddit refused, and claimed internal material — including source-code claims — was then posted. The February assessment of scope was reiterated. For response teams, this is the standard arc when stolen internal data outlives containment: disclose early, scope honestly, refuse payment, and pre-draft comms for the eventual leak drop.
Defensive lessons
- Phishable MFA is a speed bump, not a wall. TOTP codes and push prompts can be phished/relayed in real time; FIDO2/WebAuthn passkeys with origin binding break the relay because the token refuses to sign for the wrong domain.
- Fast reporters are your cheapest IR. The harmed scope was hours not days because the phished employee came forward; training that celebrates (not punishes) reports pays compounding dividends.
- Assume docs estates leak. Internal wikis/dashboards metadata (emails, advertiser contacts) don’t need SSN-grade data to hurt — business relationships get targeted by the leak’s readers.
- Plan the extortion follow-on. Data from “contained” breaches returns with a price tag months later; response comms should preview that possibility early.
- Token-binding wherever possible. Session hardening (token protection tying sessions to devices) mutes what a phisher’s minted session can reach.
Why it still matters in 2026
The Reddit phish became a canonical “MFA is not MFA” teaching case in the same season as the Uber MFA-fatigue hit and a run of high-profile adversary-in-the-middle campaigns. It accelerated the industry’s passkey migration logic — FIDO2’s origin-binding is precisely the property whose absence let this chain complete — and normalized self-report-positive culture as a measurable control. In 2026’s landscape (AI-assisted phishing at craft-union quality, OTP-relay kits commoditized), the case reads even starker: any factor a human can be talked into relaying is a factor an attacker owns. The fix was never more secrecy; it was math the user can’t be socially engineered into surrendering.
Was user account data stolen?
Reddit’s statements said no evidence indicated exposure of user account credentials, primary account data beyond limited contact metadata, or private-message content. What leaked per the actor’s June claims: internal documents, dashboards, some contact info, limited advertising data, and claimed source-code material — squarely an internal-data incident.
What’s adversary-in-the-middle phishing?
A phishing pattern where the fake page acts as a live proxy: the victim “logs in” to the attacker’s mirror, which forwards credentials and the OTP to the real site in real time, captures the minted session token, and then discards the victim. It defeats traditional OTP MFA entirely — the code was valid, just consumed by the wrong party. Passkeys defeat the relay because the client cryptographically checks the origin before authenticating.
What happened after the June leak demand?
Reddit publicly refused payment; the actor posted the material. The company reiterated its February assessment of scope. For defenders, the sequence is the standard no-pay playbook: disclose early, scope honestly, refuse quietly, prepare for the drop.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
