Discord: a trusted platform turned into a Trojan horse

• The attackers exploited a function of Discord which allows the reuse of expired or deleted invitation links, allowing them to compromise trusted community links and redirect users to malicious servers.
• The attack tricks users with a fake muzzle verification and a phishing website (Phishing) that look like legitimate servers Discord, leading victims to unknowingly execute harmful commands that download malware onto their computer.
• Malware spreads silently in multiple steps using popular, trusted services like GitHub and its Pastebin to hide his activity and avoid detection.
• The attackers mainly target cryptocurrency users and aim to make money by stealing credentials and wallet information from victims around the world. Over 1.300 downloads were tracked, with victims spanning multiple countries, including the US, Vietnam, France, Germany, the UK and others, highlighting the global scale and financial motivation behind the campaign.
  

Introduction

Discord is a widely used and trusted platform preferred by gamers, communities, businesses, and others who need to connect securely and quickly. In a recent investigation , Check Point Research ( CPR ) uncovered a flaw in Discord ’s invitation system that allows attackers to hijack expired or deleted invitation links and secretly redirect unsuspecting users to malicious servers. Invitation links posted by trusted communities months ago on forums, social media, or official websites could now silently lead users into the hands of cybercriminals.

Check Point Research ( CPR ) observed real-world attacks in which threat actors leveraged compromised links to deploy sophisticated phishing schemes and malware campaigns. These included multi-stage infections that evaded detection by antivirus tools and sandbox checks , ultimately delivering malware such as AsyncRAT and Skuld Stealer . Below is a detailed analysis of the attack and practical advice to protect the public from such attacks.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

The Hidden Danger in Referral Links Discord

Discord offers several types of invite links: temporary, permanent , and custom (custom) links. Temporary links expire after a set amount of time, permanent links never expire, and custom links are custom URLs available only on servers with premium status (Level 3 Boost ). Our research has revealed that attackers can exploit the way Discord handles expired or deleted invite codes — specifically vanity links . When a custom invite link expires or a server loses its boosted status, the invite code can become available again. Attackers can then claim the same code and redirect users to a malicious server.

In many cases, users come across these links on old, trusted sources and have no reason to suspect anything is amiss. To make matters worse, the Discord app sometimes gives users the false impression that temporary links have become permanent, which contributes to an increase in passwords that can be cracked.

From Trusted Links to Malicious Servers

Once an invitation link is compromised, attackers redirect users to malicious servers that mimic the legitimate servers. DiscordNewcomers usually find that most channels are locked, except for one called “verification.” Here, a fake muzzle with the name "Safeguard” asks users to complete a verification step.

Malicious Discord server where users end up after clicking a compromised invite link.

Clicking “verify” initiates an OAuth2 flow and redirects users to a phishing website that closely resembles Discord. The website preloads a malicious PowerShell command to the clipboard and guides users through a fake verification process. This technique, known as “ClickFix,” tricks users into executing the command through the Windows “Run” dialog box.

Once executed, the PowerShell script downloads additional assets from Pastebin and GitHub, starting a multi-stage infection chain. Eventually, the system is infected with payloads such as AsyncRAT, which gives attackers remote control, and Skuld Stealer, which targets browser credentials and wallet cryptocurrencies.

Overview of the infection chain: From PowerShell to the final delivery of the malware payload.

An Expanding and Evolving Campaign

This campaign is not static. We have seen attackers periodically update their downloader to maintain a zero detection rate on VirusTotal . We also detected a parallel campaign targeting gamers. Here, the initial downloader was embedded in a Trojanized cheat tool for The Sims 4 , demonstrating the attackers ’ flexibility in targeting different user groups.

Impact and Reach

The exact number of victims is difficult to determine due to the covert use of Discord webhooks to extract data. However, download statistics from the repositories used in the campaign show over 1.300 downloads. The victims were spread across the globe, including the US, Vietnam, France, Germany, the UK, and other countries.

The focus on the theft of cryptocurrency wallet credentials and data suggests a clear financial motive behind the attack.

A Trusted Platform That Turned into a Trojan Horse

This campaign shows how a subtle feature of Discord 's invite system can be weaponized. By compromising trusted links, the attackers created an effective attack chain that combined social engineering with the abuse of legitimate services like GitHub , Bitbucket , and Pastebin.

Instead of using heavy obfuscation, threat actors relied on simpler, more stealthy techniques such as behavior-based execution, scheduled tasks, and delayed payload decryption.

This campaign highlights the increasing sophistication of social engineering attacks that breach user trust. Rather than relying on heavily obfuscated malware, attackers used legitimate services and simple behavioral tricks to evade detection, showing how easily popular platforms can be manipulated when basic functions – such as managing invite links – remain unsecured.

Discord has since disabled the malicious bot used in this campaign, but the basic tactics remain viable. Attackers can easily register new bots or change vectors while continuing to exploit the invite system.

Stay protected

1. Double - check invite links – Always check Discord invite URLs before clicking. If a link comes from an old source (e.g., a forum post or tweet ), verify its legitimacy first.

2. Prefer permanent invite links – When managing your own Discord servers , create permanent (non-expiring) invite links. Avoid posting temporary invites publicly.

3. Check for the “ Verified App ” badge before authorizing bots – Only interact with bots that display Discord ’s official “Verified App” badge . Unverified bots may be malicious.

4. Never run unknown commands – No legitimate Discord server or verification process should require you to run PowerShell commands or paste anything into your system’s terminal. Stop and investigate if you are asked to do so.

5. Adopt layered defenses – For organizations, combine security awareness training with endpoint protection, phishing detection , and browser security tools that can stop threats before they execute.

6. Leverage proactive protection: Check Point Threat Emulation provides real-time prevention against advanced malware, phishing tactics , and file-based threats like those used in this campaign – across web, email , and collaboration tools. Behavioral analysis and sandboxing capabilities offer critical protection against evolving social engineering and multi-stage malware attacks.

For technical details, find the full research report here.

guest

Guest Post: I saw openly and entered!