Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Check Point Research uncovered a malware campaign exploiting expired Discord invite links to redirect users to malicious servers. The attackers use a combination of techniques including ClickFix phishing, multi-stage loaders, and time-based evasions to deliver AsyncRAT and a customized Skuld Stealer targeting crypto wallets. The campaign leverages trusted cloud services for payload delivery and data exfiltration to avoid detection. The operation continues to evolve, with threat actors now able to bypass Chrome's App Bound Encryption using adapted tools like ChromeKatz to steal cookies from new Chromium browser versions. The campaign highlights how subtle features in Discord's invite system can be exploited as attack vectors.

The threat campaign titled "From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery" involves a sophisticated multi-stage malware distribution operation exploiting expired Discord invite links. Attackers hijack these expired invites to redirect users to malicious servers, leveraging the inherent trust users place in Discord invite links. The campaign employs ClickFix phishing techniques to lure victims into interacting with malicious content. It uses multi-stage loaders and time-based evasion tactics to avoid detection by security solutions. The primary payloads delivered are AsyncRAT, a remote access trojan capable of extensive system control, and a customized variant of the Skuld Stealer malware specifically targeting cryptocurrency wallets, aiming to exfiltrate sensitive financial data. The attackers utilize trusted cloud services for both payload delivery and data exfiltration, which helps them blend their malicious traffic with legitimate network activity, further complicating detection efforts. Notably, the campaign has evolved to bypass Chrome's App Bound Encryption, a security feature designed to protect browser cookies, by using an adapted tool named ChromeKatz. This capability allows the threat actors to steal cookies from the latest Chromium-based browsers, potentially enabling session hijacking and unauthorized access to web accounts. The exploitation of subtle features in Discord's invite system as an attack vector highlights the innovative approach of the adversaries. Indicators of compromise include multiple malware hashes, IP addresses, and domains such as captchaguard.me and microads.top, which are involved in the campaign's infrastructure. The campaign is ongoing and continues to adapt, underscoring the persistent threat it poses to users relying on Discord and Chromium browsers.

Detailed information about From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery. Get real-time updates, technical details, and m

Title	Severity	Type	Source	Date

Threats Tagged 'skuld stealer'

Filter Threats

Threats Tagged 'skuld stealer'