Tell HN: Active XSS Attack on Reddit.com

44 pointsby haxiomic6 anni fa3 comments

When visiting reddit today some users (including me) have been experiencing a popup to a suspicious domain straight after load of reddit.com and when interacting with posts. I'm concerned such a high value XSS would be being used for something more serious than spam ad clicks

Reddit security team are aware

(I will avoid linking to relevant reddit posts for obvious reasons but you can find them on my account /u/haxiomic)

4 comments

chatmasta6 anni fa

This thread [0] is speculating it comes from a malicious advertisement. More reason to use an adblocker.

[0] https://old.reddit.com/r/cybersecurity/comments/g79s9q/activ...

[deleted]6 anni fa

crshstsh6 anni fa

I wish! Do you have any adblockers running or are you also seeing Reddit ads?

haxiomic6 anni fa

AdBlock was active and I didn't see any ads, however, I suspect they might still get the opportunity to execute js since I sometimes see them pop-in and disappear as AdBlock recognizes them

1234ftftf6 anni fa