Check Bluesky Access: 4,500 Accounts Suspended After Fake Gov Payment Phishing Compromise

Bluesky has acknowledged a phishing campaign that compromised more than 4,500 user accounts. The platform stated the attack spread through posts promoting a fake offer of a government payment. This social engineering vector tricked users into interacting with malicious content, leading to account takeover. The breach highlights the persistent risk of deceptive posts on social platforms.

The company has temporarily suspended the compromised accounts to contain the threat. Bluesky is working with the owners to secure their profiles and restore access. Users whose accounts were suspended are instructed to email [email protected] for assistance. This process allows the platform to verify identity and return control to legitimate owners.

What we know

The phishing campaign relied on posts that mimicked official government communications regarding payments. According to Bluesky, these posts served as the primary vector for the attack. The platform did not specify the technical method used to steal credentials, but the result was widespread account compromise. The sheer volume of affected users suggests a large-scale distribution of the malicious posts.

Security researchers note that such campaigns often exploit urgency or financial incentives to bypass user caution. The fake government payment angle is designed to create immediate trust and action. This tactic has proven effective in compromising thousands of accounts in a short period.

Defender's checklist

• Verify account status by attempting to log in and checking for suspension notices.
• Review recent login activity for unrecognized devices or locations.
• Change passwords for any account linked to the compromised social profile.
• Enable two-factor authentication to add an extra layer of security.
• Monitor email for official communication regarding account recovery steps.

What analysts watch for

Teams usually examine the initial vector to understand how the malware or phishing payload arrived. Analysts look for commonalities in the content used to lure victims, such as specific text patterns or image hashes. Persistence mechanisms are checked by reviewing authorized applications and sessions associated with the compromised account. Spread is analyzed by mapping the social connections of affected users to identify potential lateral movement or further recruitment.

Background: Account takeover

Account takeover occurs when an attacker gains unauthorized access to a user’s digital identity. This happens through stolen credentials, session hijacking, or authentication flaws. The attacker controls the account, accessing data and performing actions as the legitimate user, often bypassing traditional perimeter security measures entirely.

Read the full guide: Account Takeover: Definition, Vectors, and Defense Strategies

What to do and how to stay safe: Bluesky

• Check your account status immediately if you engage with posts about government payments.
• Contact the platform's support team using official channels if your account is suspended.
• Change your password and enable multi-factor authentication on all connected services.
• Monitor your inbox for verification emails from the platform to avoid follow-up scams.

Step-by-step guide: Security Advisories: Small Business Patching Strategy

General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many accounts were compromised in the Bluesky phishing campaign?

Bluesky confirmed that more than 4,500 accounts were compromised in the attack.

What was the lure used in the phishing campaign?

The attack spread through posts promoting a fake offer of a government payment.

How can users recover their suspended accounts?

Users should email [email protected] to request account restoration assistance.