Discord Turned Into an Info-Stealing Backdoor by New Malware

guest · Oct 23, 2019

Discord Turned Into an Info-Stealing Backdoor by New Malware
October 23, 2019
https://www.bleepingcomputer.com/ne...nto-an-info-stealing-backdoor-by-new-malware/

A new malware is targeting Discord users by modifying the Windows Discord client so that it is transformed into a backdoor and an information-stealing Trojan.

The Windows Discord client is an Electron application, which means that almost all of its functionality is derived from HTML, CSS, and JavaScript. This allows malware to modify its core files so that the client executes malicious behavior on startup.
Discovered by researcher MalwareHunterTeam earlier this month, this malware is called "Spidey Bot" and when installed will add its own malicious JavaScript [...]

Researcher and reverse engineer Vitali Kremez who also analyzed the malware told BleepingComputer that the infection has been seen using file names such as "Blueface Reward Claimer.exe" and "Synapse X.exe". While it is not 100% sure how it is being spread, Kremez feels that the attacker is using Discord messaging to spread the malware.
As this infection shows no outward indication that it has been compromised, a user will have no idea they are infected unless they perform network sniffing and see the unusual API and web hook calls.
Click to expand...

guest · Oct 31, 2019

Discord Abused to Spread Malware and Harvest Stolen Data
October 31, 2019
https://www.bleepingcomputer.com/ne...ed-to-spread-malware-and-harvest-stolen-data/

Malware developers and attackers are abusing the Discord chat service by using it to host their malware, act as command and control servers, or by modifying the chat client to perform malicious behavior.

As security companies shore up defenses against malware distribution and communication methods, malware developers and cyber threat actors have to evolve their tactics by abusing other services.
Below we take a look at three ways that Discord is being used; as a malware hosting and distribution service, a malware communications server, and through client modifications. [...]
While Discord has stated they will be increasing security in the future, it has not provided a plan on how they are going to do so.
Click to expand...

guest · Apr 3, 2020

Discord Turned Into an Account Stealer by Updated Malware
April 3, 2020
https://www.bleepingcomputer.com/ne...d-into-an-account-stealer-by-updated-malware/

A new version of the popular AnarchyGrabber Discord malware has been released that modifies the Discord client files so that it can evade detection and steal user accounts every time someone logs into the chat service.

AnarchyGrabber is a popular malware distributed on hacking forums and in YouTube videos that steals user tokens for a logged-in Discord user when the malware is executed.
These user tokens are then uploaded back to a Discord channel under the attacker's control where they can be collected and used by the threat actor to log in as their victims.
Modify Discord client files to evade detection
To make it harder to detect by antivirus software and to offer persistence, a threat actor has updated the AnarchyGrabber malware so it modifies the JavaScript files used by the Discord client to inject its code every time it runs.
Discord needs to do client integrity checks
In October 2019, BleepingComputer broke the news that a Discord malware was modifying the client files to turn the client into an information-stealing Trojan.
At the time, Discord had stated that they would look into ways to prevent this from happening again, but unfortunately, those plans never happened.
Click to expand...

The proper way these modifications can be detected is for Discord to create a hash of each client file when a new version is released. If a file is modified, then the hash for that particular file will change.
Until Discord adds client integrity into their client's startup, Discord accounts will continue to be at risk from malware that modifies the client files.
Click to expand...

guest · May 24, 2020

Discord client turned into a password stealer by new malware
May 24, 2020
https://www.bleepingcomputer.com/ne...urned-into-a-password-stealer-by-new-malware/

A threat actor converted the AnarchyGrabber trojan into a new malware that steals passwords and user tokens, disables 2FA, and spreads malware to a victim's friends.
AnarchyGrabber is a popular trojan that is commonly spread for free on hacker forums and within YouTube videos that explain how to steal Discord user tokens.
AnarchyGrabber3 released last week
The malware is now called AnarchyGrabber3, and with this new variant, an attacker can also steal a victim's plain text password and command an infected client to spread malware to a victim's friends on Discord.
By stealing plain text passwords, the attackers can use them in credential stuffing attacks to compromise the victim's accounts at other sites.

What makes this trojan so effective is that most people won't even know they are infected.
After the AnarchyGrabber3 executable is run and modifies the Discord client files, it does not stay resident or run again.
Click to expand...

Minimalist · Jun 20, 2020

Discord modified to steal accounts by new NitroHack malware

New malware is being distributed that pretends to be a hack that gets you the premium Discord Nitro service for free but instead steals user tokens saved in the various browsers, credit card information, and then tries to spread it to others.
Click to expand...

https://www.bleepingcomputer.com/ne...d-to-steal-accounts-by-new-nitrohack-malware/

guest · Oct 25, 2020

Is the Abaddon RAT the first malware using Discord as C&C?
October 25, 2020
https://securityaffairs.co/wordpress/109971/malware/abaddon-rat-discord-cc.html

Researchers from MalwareHunterTeam have spotted a new piece of remote access trojan (RAT) dubbed ‘Abaddon’ that is likely the first malware using the Discord platform as command and control. The Abaddon malware connects to the Discord command and control server to check for new commands to execute.
Experts also warn that the author of the malware also developed a malware feature.

In the past, other threat actors already abused the Discord platform for different purposes, such as using it as a stolen data drop.

“In the past, we have reported on how threat actors use Discord as a stolen data drop or have created malware that modifies the Discord client to have it steal credentials and other information.” reported Bleeping Computer that first reported the news.
Click to expand...

Abaddon implements data-stealing feature, it was designed to steal multiple data from the infected host, including Chrome cookies, saved credit cards, and credentials, Steam credentials, Discord tokens and MFA information.
The malware also collects system information such as country, IP address, and hardware information.
Click to expand...

guest · Nov 13, 2020

New TroubleGrabber Discord malware steals passwords, system info
November 13, 2020
https://www.bleepingcomputer.com/ne...discord-malware-steals-passwords-system-info/

TroubleGrabber, a new credential stealer discovered by Netskope security researchers, spreads via Discord attachments and uses Discord webhooks to deliver stolen information to its operators.

Its capabilities are similar to another malware strain dubbed AnarchyGrabber [1, 2, 3] that infects Discord users, also used for harvesting credentials and disabling the victims' two-factor authentication (2FA).
Netskope discovered the info stealer in October 2020 while collecting data for a previous report, with TroubleGrabber samples (detected as Razy variants) making up over 85% of all 1,650 malware samples targeting Discord during October.
Click to expand...

TroubleGrabber steals a wide range of important information including "web browser tokens, Discord webhook tokens, web browser passwords, and system information."
All this collected information is sent by the malware through chat messages using Discord webhooks to the attackers' Discord servers.

The malware was distributed via Discord in 97.8% of detected infections, "with small numbers distributed via anonfiles.com and anonymousfiles.io, services that allow users to upload files anonymously and free for generating a public download link."

"Based on the file names and delivery mechanisms, TroubleGrabber is actively being used to target gamers," Netskope concludes.
Click to expand...

Netskope: Here Comes TroubleGrabber: Stealing Credentials Through Discord

“TroubleGrabber” is a new credential stealer that is being spread through Discord attachments and uses Discord messages to communicate stolen credentials back to the attacker. While it bears some functional similarity to AnarchyGrabber, it is implemented differently and does not appear to be linked to the same group. TroubleGrabber is written by an individual named “Itroublve” and is currently used by multiple threat actors to target victims on Discord.
Click to expand...

guest · Jul 23, 2021

Never mind the trolls, Discord hosts 'significant volumes of malware' in its CDN
July 23, 2021
https://www.theregister.com/2021/07/23/discord_malware_channel/

Sophos on Thursday warned that internet instant-chat service Discord is becoming an increasingly popular malware distribution channel.

In a blog post, security sleuths Sean Gallagher and Andrew Brandt said four per cent of all TLS-protected malware – representing about 46 per cent of all malware command-and-control communication – interacts with Discord.

"Sophos products detected and blocked, just in the past two months, nearly 140 times the number of detections over the same period in 2020," they said.
Click to expand...

Discord operates its own content delivery network (CDN) to allow users to upload and share files with one another, and because it provides an API for programmatic access to the service. Miscreants thus see the channel as a potential distribution opportunity and as a provider of free infrastructure.

"We observed significant volumes of malware hosted in Discord’s own CDN, as well as malware interacting with Discord APIs to send and receive data," said Gallagher and Brandt.
But much of the malware, they said, is focused on data theft, specifically credentials and personal information. And it's often done in combination with social engineering efforts (e.g. to elicit login details or to convince targets to download and open a specific file).

Just prior to the publication of their post, said Gallagher and Brandt, there were more than 4,700 active, unique URLs in Discord's CDN pointing to a malicious Windows .exe file.
Click to expand...

Sophos: Malware increasingly targets Discord for abuse

Criminals abuse a successful chat service to host, spread, and control malware targeting their users.

Discord is not the only service being abused by malware distributors and scammers by any means, and the company is responsive to take-down requests. But Discord users should remain vigilant to the threat of malicious content on the service, and defenders should never consider any traffic from a cloud service as inherently “safe” based on the legitimacy of the service itself.
Click to expand...

guest · Aug 27, 2021

VIPSpace.exe traced in the wild
Become A VIP Victim With New Discord Distributed Malware
August 26, 2021
https://blog.minerva-labs.com/become-a-vip-victim-with-new-discord-distributed-malware

Threat actors are always looking for a way to avoid detection, and one of the most popular techniques is to use legitimate services to mask malicious network activity. A recent trend is to abuse Discord (the game-centric text and voice chat platform) as a payload distribution platform.

A new malware (named “VIPSpace.exe” in the wild) will recklessly install up to 25 different malware on a victim PC, effectively destroying infected devices.
Click to expand...

As a first stage, the malware is dropped by a self-extracting archive that drops and executes the next module, VIPSpace.exe. The secondary payload accesses Discord’s servers, downloads a BMP (bitmap) file, and saves it with a DLL extension. As it turns out, the downloaded BMP file is actually an encrypted executable that will be decrypted in the memory and reflectively loaded.
The malware’s authors have implemented a multithreaded downloading algorithm in order to speed up the infection process.

After investigating the multiple files dropped by this malware, most turned out to be benign or open-source malware, such as Redline Stealer.
Click to expand...

Services such as Discord allow hackers to execute an array of malware types during the second stage of the attack (i.e. when a BMP file is downloaded from Discord). Such malware exploits the vulnerabilities of the world’s generally reactive approach to cyber-security.
Click to expand...

guest · Oct 22, 2021

Threat Actors Abuse Discord to Push Malware
October 22, 2021
https://threatpost.com/threat-actors-abuse-discord-to-push-malware/175663/

Threat actors are abusing the core features of the popular Discord digital communication platform to persistently deliver various types of malware—in particular remote access trojans (RATs) that can take over systems–putting its 150 million users at risk, researchers have found.

RiskIQ and CheckPoint both discovered multi-functional malware being sent in messages across the platform, which allows users to organize Discord servers into topic-based channels in which they can share text, image or voice files or other executables. Those files are then stored on Discord’s Content Delivery Network (CDN) servers.
Click to expand...

Researchers warn, “many files sent across the Discord platform are malicious, pointing to a significant amount of abuse of its self-hosted CDN by actors by creating channels with the sole purpose of delivering these malicious files,” according to a report published Thursday by Team RiskIQ.
The storage of malicious files on Discord’s CDN and proliferation of malware on the platform mean that “many organizations could be allowing this bad traffic onto their network,” RiskIQ researchers wrote.
RATs and Miscellaneous Malware
Features of the latest malware found on the platform include the capability to take screenshots, download and execute additional files, and perform keylogging, CheckPoint researchers Idan Shechter and Omer Ventura disclosed in a separate report also published Thursday.

CheckPoint researchers discovered several malicious repositories among GitHub that are relevant for the Discord platform. These repositories include malware based on Discord API and malicious bots with different functionalities, they said.
Click to expand...

RiskIQ: Discord CDN Abuse Found to Deliver 27 Unique Malware Types

Although Discord was initially geared towards the gaming community, many organizations are using it for workplace communication. As a result of these malicious code files stored on Discord's CDN, many organizations could be allowing this bad traffic onto their network.

You can read the full article containing the list of IOCs in the RiskIQ Threat Intelligence Portal here.
Click to expand...

Check Point: Using Discord infrastructure for malicious intent

Check Point Research (CPR) spotted a multi-functional malware with the capability to take screenshots, download and execute additional files, and perform keylogging – all by using the core features of Discord

There are currently over 150 million monthly active users on Discord

Users must be aware that Discord’s bot framework can be easily used for malicious intent

Click to expand...

guest · Dec 6, 2021

Discord malware campaign targets crypto and NFT communities
November 25, 2021

A new malware campaign on Discord uses the Babadeda crypter to hide malware that targets the crypto, NFT, and DeFi communities.

Babadeda is a crypter used to encrypt and obfuscate malicious payloads in what appear to be harmless application installers or programs.
Starting in May 2021, threat actors have been distributing remote access trojans obfuscated by Babadeda as a legitimate app on crypto-themed Discord channels.
Click to expand...

Due to its complex obfuscation, it has a very low AV detection rate, and according to researchers at Morphisec, its infection rates are picking up speed.
Phishing on Discord
The delivery chain begins on public Discord channels enjoying large viewership from a crypto-focused audience, such as new NFT drops or cryptocurrency discussions.

The threat actors post on these channels or send private messages to prospective victims, inviting them to download a game or an app.
Click to expand...

The Babadeda deception
The malware is downloaded upon clicking the "Play Now" or "Download app" buttons on the above sites, hiding in the form of DLLs and EXE files inside an archive that appears like any ordinary app folder at first glance.

Babadeda has been used in past malware campaigns distributing info-stealers, RATs, and even the LockBit ransomware, but in this specific campaign, Morphisec observed the dropping of Remcos and BitRAT.
Click to expand...

Morphisec: Babadeda Crypter targeting crypto, NFT, and DeFi communities

The vast majority of today's NFT and crypto communities are based on Discord (a group chatting platform) channels. Discord channels are publicly accessible and allow users to send private messages to one another within a channel.

In the campaign that we observed, a threat actor took advantage of these features in order to phish victims. The threat actor sent users a private message inviting them to download a related application that would supposedly grant the user access to new features and/or additional benefits. Because the actor created a Discord bot account on the official company discord channel, they were able to successfully impersonate the channel’s official account.
Click to expand...

guest · Aug 17, 2022

Malicious PyPi packages turn Discord into password-stealing malware
August 17, 2022

A dozen malicious PyPi packages have been discovered installing malware that modifies the Discord client to become an information-sealing backdoor and stealing data from web browsers and Roblox.
The twelve packages were uploaded to the Python Package Index (PyPI) on August 1, 2022, by a user named “scarycoder,” and discovered by researchers at Snyk.

The Python packages pretend to be Roblox tools, thread management, and basic hacking modules, but none feature the promised functionality. Instead, the packages install password-stealing malware on developers’ devices.
Unfortunately, this malicious set of PyPi Python packages has not been removed from the open source package repository at the time of writing this, so software developers are still at risk.
Click to expand...

A dirty dozen
As part of a new report by Snyk, researchers analyze one of these malicious Python packages named “cyphers,” showing how malicious code hidden in the “setup.py” file is used to install two malware executables from a Discord CDN server, namely “ZYXMN.exe” and “ZYRBX.exe.”
The behavior is the same for all packages in the set, except for “hackerfilelol” and “hackerfileloll,” which use a single malicious executable named “Main.exe.”

However, even more interesting, the malware will modify the actual JavaScript files used by the Discord client to inject a backdoor that can steal information directly from your Discord account.
Click to expand...

More malware on PyPI
Yesterday, Kaspersky published a report where it presented two other PyPi packages that contain info-stealing malware and also modify the Discord client as well.

The stealers in those packages focus on collecting account credentials from cryptocurrency wallets, Steam, and Minecraft, while an injected script monitors for inputs like email addresses, passwords, and billing information.
The malicious duo discovered by Kaspersky are “pyquest” and “ultrarequests,” mimicking projects with millions of downloads and even cloning their code.
Click to expand...

Log in or Sign up

Discord Turned Into an Info-Stealing Backdoor by New Malware

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Discord Turned Into an Info-Stealing Backdoor by New Malware

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches