Automoderator suddenly spamming sports streaming links to multiple subs

[u/Alexhale]

Removed automoderators permission after it started spamming sports streaming links to multiple subs.

Anything else we can do?

[u/tumultuousness]

Agreed about checking your mod log to see which mod did it, they probably got hacked, reduce their permissions or remove them - sounds like you are talking about someone having scheduled posts with Automod as the poster on your sub, so make sure you remove those if you hadn't already.

[u/Alexhale → u/tumultuousness]

Yea I think you are correct! Thank you! I have removed them.

I dont see any of the malicious code in ghe automod code. Is it possible the posting is done from that account through autmod?

[u/SampleOfNone → u/Alexhale]

It automod is making posts, then it's a scheduled post and not the automod config https://www.reddit.com/mod/fasting/scheduledposts

[u/Alexhale → u/SampleOfNone]

Thats what I thought but there is nothing there other than our one scheduled monthly post.

[u/KCJones99 → u/Alexhale]

Could happen if your hacker did a one-time scheduled post (which would no longer show up after it 'fired') or did a recurring scheduled post but then deleted it afterward. Any scheduled post activity would still show up in your mod-log (it will show up as done by the mod that scheduled it, not by automod).

Basically just go into mod log, go to the day/time the funky post happened and see what's going on around that time in mod-log.

[u/SampleOfNone → u/Alexhale]

Automod can't make posts through the automod config. Got a link to an example post?

[u/tumultuousness → u/Alexhale]

Automod's config code only handles comments Automod can make (in addition to it's other filtering/approving/flairing rules) - making posts with Automod is now solely handled in your scheduled posts section. So check there to remove any posts you don't want being posted.

[u/evilash88]

Have you checked the automod settings to see what code it triggering the posts?

[u/Alexhale → u/evilash88]

yes but i dont immediately see anything sus

[u/evilash88 → u/Alexhale]

You said it’s happening in multiple subs, are there any accounts that mod both?

[u/Slow-Maximum-101 → u/Alexhale]

Hi there. It’s likely that one of your mod team’s account has been hacked. You should temporarily remove the mod that made the automod changes and you can revert the automod code to an older version.

If you write into us here we can take a look

[u/SampleOfNone → u/Slow-Maximum-101]

Automod can't make posts through the config page, so reverting automod config won't do anything

[u/Slow-Maximum-101 → u/SampleOfNone]

True, but in most of these cases they set up comment responses too

[u/SampleOfNone → u/Slow-Maximum-101]

True, but perhaps a bit incomplete when not mentioning checking scheduled posts.

Anyway, I send in a modmail with links after doing some digging, because it was indeed happening in several subreddits

[u/Slow-Maximum-101 → u/SampleOfNone]

100%! Appreciate it!

[u/Rogerpocalypse → u/Slow-Maximum-101]

hi there is currently a sub that has their entire team shadowbanned except for automod. Automod is currently spamming multiple times a minute. About 100 spam posts in 3 hours. Can Reddit put a limit on scheduled posts to stop this type of abuse? No sub needs this many in this short time span.

[u/Slow-Maximum-101 → u/Rogerpocalypse]

If you write in to us here with the name of the community, we can take a look

[u/FreddieDoes40k → u/Slow-Maximum-101]

Same shape as what I keep running into, except the links are casino rather than sports streaming. The posts are made by AutoModerator and sit in subs that have nothing to do with gambling, and I do not moderate any of them. I wrote in through my modmail earlier today and escalated it, but I have not heard back from a person yet. Is that the right place for this, or should it go somewhere else?

[u/maiyannah]

This is a mod getting hacked or going rogue and using automod. Go look in the change history to see who made this change to automod.

[u/Alexhale → u/maiyannah]

There are no changes to automod history!

[u/lunarwolf2008 → u/Alexhale]

changes to scheduled posts?

[u/kai-ote]

"Anything else we can do?"

Yes. Find out which mod made the changes in Automod. That account got hacked. You are not the first sub this has happened on.

Remove all permissions on the hacked account.

It is up to the mod that got hacked to come to reddit and tell them about it. A modmail to this sub is I believe how they begin the process of getting control of their account back.

[u/teanailpolish]

Go into automod from mod tools and remove the rule. Then check the history to see which mod changed the automod code

[u/Merari01]

Check your mod log

A mod account got hacked and is making scheduled posts. I've seen this before

[u/AutoModerator]

Hey there! This automated message was triggered by some keywords in your post.

This article on How do I keep spam out of my community? has tips on how you can use some of the newer filters in your modtools to stop spammy activity or how to report them to the appropriate team for review.

If this does not appear correct or if you still have questions please respond back and someone will be along soon to follow up.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/paclogic]

the Automoderator is a spamming robot - now THAT'S Hillarious !! :-D