News for hackers. Stuff that matters.

Tell HN: Active XSS Attack on Reddit.com

When visiting reddit today some users (including me) have been experiencing a popup to a suspicious domain straight after load of reddit.com and when interacting with posts. I'm concerned such a high value XSS would be being used for something more serious than spam ad clicks

Reddit security team are aware

(I will avoid linking to relevant reddit posts for obvious reasons but you can find them on my account /u/haxiomic)

( 3 comments | 44 points | on HN )
Re:Tell HN: Active XSS Attack on Reddit.com by chatmasta on Friday April 24, 2020 @06:11PM (#22973443)
This thread [0] is speculating it comes from a malicious advertisement. More reason to use an adblocker.

[0] https://old.reddit.com/r/cybersecurity/comments/g79s9q/activ...

Re:Tell HN: Active XSS Attack on Reddit.com by crshstsh on Friday April 24, 2020 @02:58PM (#22971713)
I wish! Do you have any adblockers running or are you also seeing Reddit ads?
Re:Tell HN: Active XSS Attack on Reddit.com by haxiomic on Friday April 24, 2020 @03:05PM (#22971767)
AdBlock was active and I didn't see any ads, however, I suspect they might still get the opportunity to execute js since I sometimes see them pop-in and disappear as AdBlock recognizes them