CampaignPublished 20 Jun 2025Updated 20 Jul 2025

Discord Invite Hijacking: How Fake Links Are Delivering Infostealers

Source AlienVault OTX General

Description

Cybercriminals are exploiting Discord's invite system and content delivery features to distribute malware and steal sensitive data. They use fake invite links, expired codes, and vanity URLs to redirect users to malicious servers. The attack chain involves a sophisticated combination of social engineering, multi-stage loaders, and time-based evasion tactics. Victims are tricked into authorizing a fake bot, which leads to the deployment of AsyncRAT and a customized Skuld Stealer. These malware variants target browser credentials, Discord tokens, and cryptocurrency wallets. The campaign uses trusted platforms like GitHub and Bitbucket to host encrypted payloads, and employs advanced techniques to bypass security measures and maintain persistence.

Impact

European organizations, particularly those with active Discord communities or employees who use Discord for communication, are at risk of credential theft, unauthorized access, and financial loss due to cryptocurrency wallet compromise. The theft of browser credentials and Discord tokens can lead to further lateral movement within corporate environments if these credentials are reused or linked to corporate accounts. The deployment of AsyncRAT allows attackers to gain persistent remote access, potentially leading to data exfiltration, espionage, or disruption of services. Organizations in sectors with high cryptocurrency usage or those involved in gaming, software development, or online communities may face increased risks. The use of trusted platforms like GitHub and Bitbucket to host payloads complicates detection and response efforts, increasing the likelihood of prolonged undetected compromise. Additionally, the social engineering aspect means that even well-secured environments can be vulnerable if users are not adequately trained to recognize malicious invites and bot authorization requests. The campaign’s multi-stage and time-based evasion tactics further reduce the effectiveness of traditional signature-based defenses, increasing the potential impact on confidentiality, integrity, and availability of affected systems.

Defensive guidance

1. Implement strict Discord usage policies within organizations, including restricting the authorization of bots to verified and trusted entities only. 2. Educate users on the risks of clicking on unsolicited Discord invite links, especially those that appear expired or use vanity URLs, and train them to verify invite legitimacy through official channels. 3. Deploy endpoint detection and response (EDR) solutions capable of detecting behaviors associated with AsyncRAT and Skuld Stealer, such as unusual process injection, credential dumping, and persistence mechanisms. 4. Monitor network traffic for suspicious connections to GitHub, Bitbucket, or other code hosting platforms that may be used to fetch encrypted payloads, and apply anomaly detection to identify unusual patterns. 5. Enforce multi-factor authentication (MFA) on all critical accounts, including Discord and cryptocurrency wallets, to reduce the impact of stolen credentials. 6. Regularly audit and revoke unnecessary bot authorizations within Discord servers to minimize attack surface. 7. Employ threat hunting focused on indicators of compromise related to this campaign, such as detection of AsyncRAT command and control traffic or Skuld Stealer activity. 8. Use application allowlisting to prevent unauthorized execution of unknown binaries and scripts that may be part of the multi-stage loaders. 9. Maintain up-to-date security awareness programs emphasizing the risks of social engineering attacks via collaboration platforms. 10. Collaborate with Discord and platform providers to report suspicious invite links and malicious bots promptly.

Indicators of compromise

Domains 7

captchaguard.me
discord-giveaway.net
discordapp-login.com
discordgifts.net
discordnitro.gift
microads.top
request.open

IP addresses 3

101.99.76.120
185.234.247.8
87.120.127.37

Hashes 29

3d32539314f681bc250ee749e1dc4538
4ef039f4fdd0df3a9d20feb34b1cfd62
6e397edeb705cdd9de4cb2f16dbed271
7834b9b4574b68ba85eabd79b9770b08
8a5449c0ed6d73f0dc1be74156413d02
b5d26bf46c4732be2a28ba4fc88d4241
c6b5034526b90943b8c478494068a08d
f9db8601d94df9c026331066a2ba9ae1
fc13b02d22f6fe582e2948259660e3d5
363a97ec2f5b63c9d5e8f0f2daf487c9db423a58

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Jun 2025, 14:18 UTC

MITRE ATT&CK techniques17 from threat tags

Technical details

Indicators of compromise

Domains 7

IP addresses 3

Hashes 29

Community reviews

Related threats