@kroner @dcc @spitfire Graf is saying they got hold of his OAuth token to impersonate him, though it's not clear to me how (server breach or client device breach?).

It might be a Pleroma-specific vulnerability. Apparently he's working with Alex to figure it out.