Today at 13:00 UTC what looked like a massive automated vote occurred on Steem. The SteemConnect API received a lot of requests to upvote and downvote the following posts without user approval:
We can see from the SteemConnect logs that a malicious actor used Utopian privileges to broadcast votes for users. If you have delegated posting authority to the 
To check your history, go https://steemd.com/@fabien (change 
We’ve disabled the app
Utopian asks for “offline access” when using SteemConnect, this gives the Utopian app the ability to issue an access token for its users anytime with what we call “refresh token”. It’s a common use in the OAuth 2 standard. It seems that someone got access to Utopian’s database with stored refresh tokens. These refresh tokens were used to generate new access tokens and broadcast votes for these accounts. If your account has been affected you most likely were giving offline access to Utopian.
No. Someone malicious sent requests to the SteemConnect API using Utopian’s refresh tokens but does not have direct access to the SteemConnect server.
Neither SteemConnect nor Utopian have access to any of your keys. SteemConnect API is using posting authority delegation to broadcast posting operations for you. The operations are signed by the 
We are still investigating this issue and will give you another update when we have.
Edit: You can read Utopian related post here: https://steemit.com/utopian-io/@utopian-io/utopian-io-hack-may-3rd-may-4th-2018-no-wallets-or-keys-compromised
