u/yajirushi77

Hey everyone,

I'm writing this in regards to the MrBeast scam that has been going around Discord lately. Recently I have noticed an epidemic of folks getting hacked by this very scam and based on my initial research I have concluded that this is a Infostealer or a token logger so to say and that most people contract it via downloading cracked games, software, mods or something that was attached to some download file you found on the internet and from what I have gathered, it just doesn't stop there. It seems that this type of malware gets every account you have saved on your computer. Your social media, steam, and all your other accounts and it's so bad that if you get infected, the best thing you can do is to completely wipe your computer and do a fresh install which is the ultimate nuclear option. The worst part? This bypasses 2FA which is the scariest part of this.

And after reading about this and seeing a couple of my buddies fall for the MrBeast scam it's got me thinking... Perhaps it is time for me to buy a Yubikey and link all of my accounts to said Yubikey. My buddy who got hacked and nearly lost his steam, Fortnite, Roblox, and Discord accounts, immediately went ahead and purchased a Yubikey and linked his email, Steam, Fortnite, Discord, and every single important account onto that Yubikey and ever since then he has been preaching everyone including me to purchase it which I am very close to.

I take my account security very seriously. I've got 2FA installed everywhere but with this MrBeast scam going around everywhere it's making me feel that not even 2FA can protect you as this InfoStealer is a very common piece of malware that an average user can easily come into contact with and I do not want to become another victim of this. So, my question for everyone here is what exactly does YubiKeys do that differentiates from your standard authentication 2FA? All my accounts use authentication apps IE: Microsoft authenticator. I know this is a physical key that stores every account you link to it onto that device and you can simply plug it in and you're into your account and another question, can InfoStealers like the MrBeast scam bypass 2FA and can the malicious actor remove your Yubikey from your account? And is having a Yubikey give you a much easier time to restore your compromised account versus you not even having one? I ask these questions as a concerned user as well as someone who has come from the field of IT and who takes account security very seriously.

I appreciate the insights everyone.

Hey everyone,

I'm writing this in regards to the MrBeast scam that has been going around Discord lately. Recently I have noticed an epidemic of folks getting hacked by this very scam and based on my initial research I have concluded that this is a Infostealer or a token logger so to say and that most people contract it via downloading cracked games, software, mods or something that was attached to some download file you found on the internet and from what I have gathered, it just doesn't stop there. It seems that this type of malware gets every account you have saved on your computer. Your social media, steam, and all your other accounts and it's so bad that if you get infected, the best thing you can do is to completely wipe your computer and do a fresh install which is the ultimate nuclear option. The worst part? This bypasses 2FA which is the scariest part of this.

And after reading about this and seeing a couple of my buddies fall for the MrBeast scam it's got me thinking... Perhaps it is time for me to buy a Yubikey and link all of my accounts to said Yubikey. My buddy who got hacked and nearly lost his steam, Fortnite, Roblox, and Discord accounts, immediately went ahead and purchased a Yubikey and linked his email, Steam, Fortnite, Discord, and every single important account onto that Yubikey and ever since then he has been preaching everyone including me to purchase it which I am very close to.

I take my account security very seriously. I've got 2FA installed everywhere but with this MrBeast scam going around everywhere it's making me feel that not even 2FA can protect you as this InfoStealer is a very common piece of malware that an average user can easily come into contact with and I do not want to become another victim of this. So, my question for everyone here is what exactly does YubiKeys do that differentiates from your standard authentication 2FA? All my accounts use authentication apps IE: Microsoft authenticator. I know this is a physical key that stores every account you link to it onto that device and you can simply plug it in and you're into your account and another question, can InfoStealers like the MrBeast scam bypass 2FA and can the malicious actor remove your Yubikey from your account? And is having a Yubikey give you a much easier time to restore your compromised account versus you not even having one? I ask these questions as a concerned user as well as someone who has come from the field of IT and who takes account security very seriously.

I appreciate the insights everyone.

Hey everyone,

I'm writing this in regards to the infamous MrBeast Discord scam that many of you may have fell victim to and also others who you know that may have been affected by this scam. Just recently, a friend of mine has unfortunately fell victim to this scam and his Discord got hacked and the bad actor then proceeded to send everyone and every server he was in pictures of the MrBeast scam to everyone's DMs and servers. Fortunately, he did manage to secure his account and when I did reach out to him I asked him how in the world did he get his Discord hacked to which he told me he absolutely has zero idea.

I asked him the basic questions. Did he click on any malicious links, fell for any phishing scams, the typical stuff you ask someone when they had just recovered their account or when their account got compromised and he hasn't. And so, this led me here. I do have a background when it comes to IT and basic cybersecurity when it comes to how your account can get stolen. I am aware of phishing links, keyloggers, token grabbers, etc and I am an unfortunate victim to having an account compromised when I fell for a phishing link where I entered my personal info. I know. People like me can fall for this as well even though we know best.

So now, I decided to go into the rabbit hole and figure out how this scam works and I am having a hard time trying to wrap my mind around how this works as dozens of people including my buddy tells me he has no idea what happened which tells me in a IT point of view that this goes far deeper than your usual scamming/hacking incident. How exactly does this work? How deep does this go? What causes this hack to happen in the first place and does it affect more than just your Discord server and can this bypass both 2FA and passkeys? I have physical passkeys that I use for my most secure and sensitive accounts and I am the type of person who treats account security like Fort Knox.

And if you do fall victim to this scam and you do end up getting your account compromised. Apart from changing your password, securing your account and enabling 2FA which obviously I am sure most of us have done so already, what should your next actionable steps on recovering from this? And does this scam affect more than just your Discord account but also your computer? If anyone has a full technical answer for me please let me know as I'd want to educate my buddy and also learn how they get you nowadays as scams and getting your account compromised has certainly evolved with time.

Thanks.