New Discord malware attack
pretty much what the title says. There’s currently a new socially engineered malware attack on Discord since possible around July, and currently it is vicious. I’ll make a brief explanation of what it is, what to do if you click on the link and a measure me and some friends have done.
A direct message from a friend (currently) talking about checking out the game they're working on. The typing style may look very similar to what they actually talk like. What clicking on the link does is steal your account, install a downloader (most likely a crypto miner), a keylogger, harvest logins from all your browsers and possibly something else since this is very new. While its a simple “don’t click any suspicious links” advice since the start of the internet, I’m making this for those that are unaware.
here’s an analysis of what it does:
[ID: Doing some analysis now, it's absurd, the thing BROKE MY DEBUGGER, it got a lot of weird misplaced bytes in the exe header and a tentative of buffer overflow that didn't work thankfully because I was in linux, so the kernel just crashed -.- This thing is a Node Executable as front, have a token stealer, have code to break into passwords kepts in lots of places of your OS (covers every browser), it also monitors your network, hooks NtOpenKey, WSASend, WSARrecv, AND EVEN CREATEPROCESS. Oh yeah, it also hooks to your key inputs, so call it a keylogger too. It's designed to break debuggers and try to f*ck with you... from inside the debugger, without executing it. It's a complete Security Stealing Ware. Didn't find anything that could point tentatives to mess with your bios/firmware (in these cases, even reinstalling the OS may not be secure enough lol) I still can't believe a virus just tried to do with me, what I try to do with the Switch and PS4 on my spare time lol. end ID]
What to do if you click on the link
this screenshot (and entire post) is from twitter user @/PhleBuster and it goes in detail on what to do if you actually click the link.
[ID: @everyone Related to the ongoing socially engineered malware attacks, if you end up unfortunately executing code given to you by an attacker, here's what you need to know: #0 Disconnect internet from your PC RIGHT AWAY - if you do this fast enough you may be able to stop your accounts from getting stolen. #1 Change your Discord password RIGHT AWAY, on your MOBILE. This is their first priority and unless you act immediately, you will lose access and it will be very slow to recover via support. #2 Change your email and other critical passwords, on your MOBILE. This malware is extremely advanced, won't be caught by any existing virus scanners, and will install a downloader, likely a crypto miner, a keylogger, will harvest logins from all your browsers, and who knows what else. [in bold:] If you are exposed and didn't immediately disconnect internet, expect that all of your existing logins have been compromised - and any changes you make on PC will be immediately leaked as well. [normal font:] #3 Do a clean reinstall of Windows. A system restore is not safe enough. #4 While that happens, report any stolen accounts, and keep changing the rest of your passwords. #5 After reinstall, change all your passwords one more time, and you should be safe. #X - if you are notified of any suspicious login attempts to any account, immediately attempt to recover it with password recovery before your logins, emails, and other support details are changed. #Y - If you lose access to any accounts, do your best to notify your friends who may be vulnerable to further attacks through that attack. ID end]
Prevention between friends
Since this is still relatively a new attack, please take this part with a big grain of salt. Me and my friends made a system for our own group of sending a personalized message between a spoiler filter before sending links. I’m not sure how the hacked message is supposed to look since from my own research, it just looks like your regular spam message. Try to figure out a 2FA system with your friends on what links are trustworthy. While it is currently a “hey check out my game” type of message, it worries me that it might spread to other types of links.
I’ll try to update this if any new information arises, but please stay wary of any links being sent on discord. Stay safe
