MalwareZero
A writer's hands on a laptop keyboard in a quiet home office at dusk, the screen showing a publishing dashboard with the cursor hovering over a comment field in soft window light

Comments and writers

The Substack Comment Phishing Link, October 2026

Updated 19 October 2026

You did not get hacked by a stranger on a forum. You got fished by a polite comment on a post you already trusted, and the link inside it looked like it belonged there. That is the entire trick, and it is the reason a Substack comment phishing link in October 2026 is more expensive than a text scam: writers do not expect their own comment thread to be the delivery vehicle.

The lure arrives as a comment on a post you have already subscribed to, or on a public post by a writer in your topic. The comment is short, on topic, and almost flattering. It says something like Great breakdown, this expanded on it for me or Had to share the data point you were missing. The link inside the comment uses the real Substack domain in the visible text, but the underlying href points at a lookalike, a free subdomain, or a link shortener that masks the destination.

By October 2026 the pattern has tightened. Researchers at multiple newsletters reported that the bait is no longer a generic login-substack.com clone. The current crop uses a Substack styled sign in card, prefilled with the writer's publication name and avatar, and asks for an email and password to verify subscription or to unlock the rest of the comment. A second wave uses a fake unsubscribe page hosted on a subdomain of the writer's own site, served after a single click, which is enough to grab the session cookie on older browsers.

The reason this lands is the comment thread itself. Substack does not strip links from comments, and the platform lets any signed in account comment on any open publication. Writers reading their own comments are conditioned to follow links because that is how readers send them sources. Readers reading comments under a post they paid for are conditioned to treat the thread as a curated space. The phishing link rides on that trust.

A close up of a paper notebook on a wooden desk with a handwritten password, a pen resting beside it, a coffee mug steaming in the background of a small study at midday interior

Two audiences, and they are not who most people assume.

The first is the writer. A writer's Substack account is the keys to the publication. It controls the mailing list export, the paid tier settings, the connected Stripe account, and the writing identity itself. A hijacked writer account can be used to push a crypto wallet drainer post to every subscriber within minutes, and the post will arrive from an address the audience already trusts. This is the higher value target, and the comments are aimed at writers who publish in finance, crypto, security, and politics, where readers click fast and the audience is the asset.

The second is the reader, and the goal is different. Reader accounts on Substack do not hold money directly, but they do hold a verified email, a list of subscriptions, and an OAuth token that can be replayed against other services. The phishing page that verifies subscription does not need to look like a bank. It needs to look like a step the reader expects after commenting, and the captured password gets tested against Gmail, iCloud, and bank logins within hours.

Both groups are conditioned to act without checking. That is the design. The Substack comment phishing link does not need to beat a spam filter. It needs to beat a habit.

Four signals cover most of what is circulating in October 2026.

One. The comment is generic but on topic. Really useful, saved this for my team under a 2,000 word essay is not a compliment, it is a hook. Real readers either engage with the argument or ask a specific question. Bait comments do neither.

Two. The link preview does not match the visible text. On desktop, hover the link. The status bar at the bottom of the browser should show the real destination. If the visible text reads substack.com but the status bar shows stackauth-id.page.link or a country code TLD you do not recognise, that is the lure.

Three. The comment asks you to do something off platform to read more. Full thread here, verification needed to view, and this is the only way to see the reply are all pretexts. Substack comments are public on open publications and do not require any extra step to read.

Four. The comment arrives on a post you commented on first. If you wrote a substantive comment under a post and then receive a short reply with a link from a different account, treat it as hostile. Reply chains are a known delivery vehicle and the reply account is usually hours or days old.

The first hour matters because the captured session is hot. A Substack session cookie, if the phishing kit grabbed one, is good for roughly an hour on a mobile browser and longer on desktop. Move fast.

Step one. Open Substack on a fresh browser, not the one that clicked the link, and change your password. Pick a password you have not used anywhere else. If you do not have a password manager, use the one built into your browser and let it generate one. Write it down once on paper if you have to, but do not reuse.

Step two. Revoke active sessions. Substack exposes this under Settings, Publishing, or Account depending on whether you are a writer or a reader. Look for Sign out of all other sessions or a list of devices. Hit it. This kills the session token the phishing kit is holding.

Step three. Pull connected apps. The Substack account settings page lists third party services you have linked, including Google sign in, Apple sign in, and any OAuth apps you granted during a previous login. Remove anything you do not recognise, and remove anything you do not actively use. A writer account connected to a dead Zapier or Buffer integration is a soft target.

Step four. Rotate the email account tied to Substack. The phishing page asked for an email and a password. Assume both are now in a database. Change the password on the email account itself, then turn on two factor authentication if it is not already on. Authenticator app only. SMS codes are a separate attack surface and a Substack account does not need to be the entry point if the email is the weak link.

Step five. If you are a writer, audit your last ten posts. The account takeover kits in circulation in October 2026 are patient. Some wait 24 to 48 hours, then post a special issue with a wallet drainer or a fake airdrop claim. If you can, post a short note from a clean device saying you are back in control and that any message from your account in the last 48 hours should be treated as hostile.

If the writer you subscribe to got phished, not you

Readers get caught in the blast radius when a writer's account is taken over. The hijacker posts a special issue or a chat message that looks like the writer, links to a wallet drainer, an airdrop claim, or a fake token launch. The post is on brand, the voice is right, and the link is the trap.

Treat any Substack post that asks you to connect a wallet, sign a message, or paste a seed phrase as hostile, full stop. Substack is a publishing platform. It does not need your seed phrase. It does not need you to sign a transaction. If a post you trust asks for either, the writer has been compromised and the post is the payload.

Report the post inside Substack using the Report link under the post menu. Do not email the writer to warn them. The hijacker is reading the writer's email. If you have a way to reach the writer off platform, such as a known social account or a personal site, use that. Otherwise the report is the fastest route.

Why the comment thread is the new phishing surface

Email gateways have spent twenty years getting hostile. The default Substack comment in October 2026 is closer to a 2014 blog comment than a 2024 email. The platform does not sandbox link clicks, does not show a full URL by default on mobile, and does not flag shortener links. The result is that the comment thread is the place where an attacker can put a hostile link in front of a reader who has already raised their guard for the post itself.

This is a pattern, not a one off. The same shape is now visible on Ghost, on Beehiiv, and on the comment widgets embedded in independent blogs. The lure moves with the audience. The defence is the same in all of them. Read the comment before you click the link. Hover on desktop. Long press on mobile and copy the link without opening it, then paste it into a notes file and look at the domain with your eyes, not your habit.

Quick answers

Can a Substack comment infect my computer with malware just from opening it?
No. Reading the comment text is safe. The risk is the link inside the comment and the page it lands on. Treat the link as the threat, not the comment itself.
Does Substack scan comment links for phishing?
Substack applies some link scanning, but the comment system is designed for open discussion and the scanning lags the kits. Do not rely on it. Check the link yourself.
I clicked but did not type my password. Am I safe?
Probably, but not certainly. Clear your browser cookies for substack.com, run a browser level scan, and watch your email account for the next 48 hours. If you are a writer, audit your connected apps and your draft folder.
Should I message the writer to warn them their comments section is being used?
Only through a channel you already trust. If the writer's email is tied to the same Substack account, the hijacker may be reading it. A report through the post's Report link is the safer first move.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.