CampaignPublished 13 Jun 2025Updated 13 Jul 2025

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery

Source AlienVault OTX General

Description

Check Point Research uncovered a malware campaign exploiting expired Discord invite links to redirect users to malicious servers. The attackers use a combination of techniques including ClickFix phishing, multi-stage loaders, and time-based evasions to deliver AsyncRAT and a customized Skuld Stealer targeting crypto wallets. The campaign leverages trusted cloud services for payload delivery and data exfiltration to avoid detection. The operation continues to evolve, with threat actors now able to bypass Chrome's App Bound Encryption using adapted tools like ChromeKatz to steal cookies from new Chromium browser versions. The campaign highlights how subtle features in Discord's invite system can be exploited as attack vectors.

Impact

For European organizations, this campaign poses significant risks, particularly to entities with employees or users who actively use Discord and Chromium-based browsers. The targeted theft of cryptocurrency wallet data threatens financial assets, which is especially relevant for fintech companies, cryptocurrency exchanges, and individuals involved in digital asset management. The use of trusted cloud services for payload delivery and exfiltration complicates detection and response, increasing the likelihood of successful breaches. The ability to bypass Chrome's App Bound Encryption and steal browser cookies can lead to session hijacking, unauthorized access to corporate web applications, and potential lateral movement within networks. Phishing via hijacked Discord invites can also lead to initial compromise of endpoints, potentially resulting in data breaches, intellectual property theft, and disruption of business operations. The multi-stage and time-based evasion techniques mean that traditional signature-based defenses may be insufficient, increasing the risk of prolonged undetected presence within networks. Overall, the campaign can impact confidentiality, integrity, and availability of organizational data and systems, with potential financial and reputational damage.

Defensive guidance

1. Implement advanced email and messaging security solutions that can detect and block phishing attempts, including those leveraging social platforms like Discord. 2. Educate employees and users about the risks of clicking on expired or suspicious Discord invite links and encourage verification of invite legitimacy before interaction. 3. Deploy endpoint detection and response (EDR) tools capable of identifying multi-stage loaders and unusual process behaviors indicative of AsyncRAT or Skuld Stealer infections. 4. Monitor network traffic for connections to known malicious domains and IPs associated with this campaign (e.g., captchaguard.me, microads.top) and block them at the firewall or proxy level. 5. Enforce strict browser security policies, including disabling or restricting extensions and plugins that could be exploited, and regularly update Chromium-based browsers to the latest versions with security patches. 6. Utilize multi-factor authentication (MFA) for access to critical systems and web applications to mitigate risks from stolen cookies and session hijacking. 7. Conduct regular threat hunting exercises focusing on indicators of compromise related to AsyncRAT, Skuld Stealer, and ChromeKatz activity. 8. Limit the use of cloud services for sensitive data transfer unless encrypted and monitored, and apply strict access controls. 9. Implement network segmentation to contain potential infections and reduce lateral movement opportunities. 10. Collaborate with Discord and cloud service providers to report and remediate hijacked invite links and malicious infrastructure promptly.

Indicators of compromise

Domains 3

captchaguard.me
microads.top
request.open

URLs 1

https://captchaguard.me/?key=

IP addresses 2

101.99.76.120
87.120.127.37

Hashes 15

7834b9b4574b68ba85eabd79b9770b08
fc13b02d22f6fe582e2948259660e3d5
4501e8029fedadab2cbaa9e504301200c4cd2bfe
d383b44cb3c7e5a2e460300182d89932869a7281
160eda7ad14610d93f28b7dee20501028c1a9d4f5dc0437794ccfc2604807693
375fa2e3e936d05131ee71c5a72d1b703e58ec00ae103bbea552c031d3bfbdbe
53b65b7c38e3d3fca465c547a8c1acc53c8723877c6884f8c3495ff8ccc94fbe
5d0509f68a9b7c415a726be75a078180e3f02e59866f193b0a99eee8e39c874f
670be5b8c7fcd6e2920a4929fcaa380b1b0750bfa27336991a483c0c0221236a
673090abada8ca47419a5dbc37c5443fe990973613981ce622f30e83683dc932

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Jun 2025, 20:49 UTC

MITRE ATT&CK techniques17 from threat tags

Technical details