The attack needs no authentication — only one public project that can hold the .org payload.