Cybersecurity researchers have uncovered a sophisticated malware campaign that exploits a critical weakness in Discord’s invitation system to distribute the Skuld information stealer and AsyncRAT remote access trojan.

## How the Attack Works

According to Check Point’s technical report, attackers are hijacking Discord invite links through vanity link registration, enabling them to silently redirect users from trusted sources to malicious servers. The campaign combines multiple advanced techniques including ClickFix phishing, multi-stage loaders, and time-based evasions to deliver malware while avoiding detection.

The vulnerability lies in Discord’s invite mechanism, which allows attackers to claim expired or deleted invite links and redirect unsuspecting users to malicious servers. This means previously trusted Discord links shared on forums or social media platforms can unknowingly lead users to dangerous sites.

## The Attack Chain

The attack follows a carefully orchestrated process:

1. **Link Hijacking**: Attackers take control of legitimate community invite links and redirect them to malicious Discord servers
2. **Social Engineering**: Users joining these servers are prompted to complete a “verification” step by authorizing a bot
3. **ClickFix Technique**: Victims are directed to a fake website with a “Verify” button that secretly executes JavaScript, copying a PowerShell command to their clipboard
4. **Malware Execution**: Users are tricked into running the copied command through Windows Run dialog, triggering the download and execution of malware

## Malware Payloads

The campaign delivers two primary threats:

**AsyncRAT**: A remote access trojan providing comprehensive system control, using a “dead drop resolver” technique to access command-and-control servers through Pastebin files.

**Skuld Stealer**: A Golang-based information stealer targeting:
– Discord credentials
– Browser data
– Cryptocurrency wallets (especially Exodus and Atomic)
– Gaming platform information

Skuld employs “wallet injection” techniques, replacing legitimate application files with trojanized versions downloaded from GitHub. It also uses a modified ChromeKatz tool to bypass Chrome’s encryption protections.

## Evasion Tactics

The attackers demonstrate sophisticated evasion capabilities by:
– Using trusted cloud services (GitHub, Bitbucket, Pastebin, Discord) for payload delivery and data exfiltration
– Blending malicious traffic with normal network activity
– Implementing sandbox security checks to avoid detection

## Global Impact

Victims are primarily located in the United States, Vietnam, France, Germany, Slovakia, Austria, the Netherlands, and the United Kingdom. Check Point identified a secondary campaign distributing the same loader disguised as a game-cracking tool, which has been downloaded 350 times.

## Response and Implications

Discord has disabled the malicious bot, breaking the attack chain. However, this campaign highlights a fundamental security flaw in Discord’s invite system that allows the reuse of expired or deleted invite codes in vanity links.

The targeting of cryptocurrency wallets and the sophisticated multi-stage approach suggest attackers are primarily motivated by financial gain, specifically targeting crypto users. This represents the latest example of cybercriminals exploiting Discord’s platform, which has previously seen its content delivery network abused for malware hosting.

The campaign demonstrates how seemingly minor platform features can become powerful attack vectors when exploited by determined threat actors.