Duolingo PRO was reported 05.08.2026 for Schadsoftware
The reporter said:
Steals Duolingo JWT/session token and sends it to api.duolingopro.net, allowing full account takeover.
This script has been updated since the report was filed.
This script has had 2 previous upheld or fixed reports.
anonymoushackerIV (the reported user) has made:
interstellar (the reported user) has made:
This report has been upheld by a moderator, but the moderator marked it as Fehlende, nicht informative oder irreführende Beschreibung.
Although there's no evidence of malware but the description should explicitly mention this or the code should be reworked to make requests directly from the webpage