Post #2795736

@troed@ioc.exchange Turns out the attacker initiated account recovery over the phone using stolen personal information. The link was the last step, which had to be clicked from a device Amazon already recognized for that account. And the firehose of spam was to bury the alert emails Amazon was sending.