Discord bots are being used in information-stealing campaigns
Newly discovered infostealer sends all of the information gathered to Discord
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Hackers have been observed using Discord to grab data harvested on compromised computers, experts have warned.
In a newreport, Trellix cybersecurity researcher Gurumoorthi Ramanathan detailed themalwareand the data exfiltration techniques it used.
According to the report, the threat actors built a sophisticated infostealer called NS-STEALER. They’re distributing it via ZIP archives impersonating cracked software. When a victim extracts the archive file, they will find a Windows shortcut titled “Loader GAYve” which, if executed, will deploy a malicious Java program. This program will do two things: first it will create a folder called “NS-<11-digit_random_number>”, to which it will store all of the information harvested. Then, it will start grabbing the data.
Cost-effective data exfiltration
NS-STEALER will look for information stored in more than two dozen browsers - cookies, credentials, and autofill data. Then, it will start taking screenshots of the infected device, grabbing system information, and the list of programs installed on the device. It will then pull Discord tokens, as well asSteam, and Telegram session data.
Finally, it will exfiltrate all of the above to a Discord Bot channel.
“Considering the highly sophisticated function of gathering sensitive information and using X509Certificate for supporting authentication, this malware can quickly steal information from the victim systems with [Java Runtime Environment],” Ramanathan said.
“The Discord bot channel as an EventListener for receiving exfiltrated data is also cost-effective."
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
This is hardly the first time hackers found a way to abuse Discord for their nefarious purposes. In fact, Discord has been abused for years now. Back in 2020, researchers from MalwareHunterTeam found a remote access trojan (RAT) that used Discord as a command and control (C2) server. That same year, researchers saw a version of the AnarchyGrabber trojan used to steal victims’ plain text passwords and even command an infected client to spread malware to their Discord friends.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Washington state court systems taken offline following cyberattack
Is it still worth using Proton VPN Free?
7 myths about email security everyone should stop believing
