Hackers use Discord Invite Links to deliver malware

A new campaign for malware has been revealed targeting Crypto users via Discord Invite Links. According to the information, the new malware is taking advantage of the weaknesses of Discord’s invitation system to provide information stealing known as Skuld and Asyncrat Remote Access Trojan.

In a checkpoint report, the platform said that attackers can hijack links via Vanity Link registrations and easily redirect users from trusted sources to malicious servers.

“The attackers secretly provided a customized Skuld Stealer targeting Asymprato and crypto wallets, combining Clickfix phishing technology, multistage loaders, and time-based evasion,” Check Point said.

According to the platform, one use of Discord’s invitation mechanism is that an attacker can hijack an expired or deleted invitation link, secretly redirecting unsuspecting users to various malicious servers under their control. This means that users can be directed to malicious servers or platforms using links that invite previously shared links for legitimate purposes on social media and other forums.

Discord Invite Link was hijacked for malicious purposes

The development will be just over a month after cybersecurity companies uncover another sophisticated phishing campaign in which they hijacked expired vanity links to seduce users, to join in discrepancies servers, and instructed them to visit phishing sites to confirm ownership. The malicious actor eventually used the platform to gain illegal access to users’ digital wallets and drain the wallet after connecting them.

Users can create temporary, permanent, or custom invitation links in Discord, but the platform does not allow other legitimate servers to retrieve previously expired or deleted invitation links. However, when users create custom links, they can reuse expired invitation codes and, in some cases, permanent invitation codes that have been deleted.

This ability to reuse expired or deleted code when creating custom Vanity Invite Links allows criminals to abuse it, most of which claim them against malicious servers. “This creates serious risk. Users who follow previously trusted invitation links (for example, websites, blogs, or forums) can unconsciously redirect them to forge discrepancies created by threat actors,” Check Point said.

According to the report, Discord Invite Link Hijacking involves redirecting users to malicious servers using legitimate invitation links shared by the community. Victims of this scheme are asked to complete a validation stamp that includes entering some details to gain full access to the server. This is done by approving the bot. This leads you to a fake website that is mandatory to verify the information provided. After this, the scammer uses social engineering tactics to trick users into infecting the system.

Malicious actor steals wallet seed phrases with malware

According to reports, Skuld malware can harvest seed phrases from Exodus and Atomic Cryptography Wallets. Perform this activity using an approach called wallet injection, replacing the original version of the application file with the version loaded with the Trojan horse downloaded from GitHub. Another payload is Goland Information Stealer, which can be downloaded from Bitbucket. It is used to steal sensitive data from Discord, various browsers, crypto wallets and gaming platforms.

Checkpoint added that it also identified another malicious campaign running by the same threat actors that distribute the loader as a modified version of the hack tool to unlock pirated hams. According to the report, the program has been downloaded 350 times on Bitbucket. The victims of these campaigns are primarily in the United States, France, Slovakia, the Netherlands, Austria, Vietnam and the UK.

The findings provide the latest examples of how cybercriminals target platforms. “The campaign illustrates the subtle features of Discord’s invitation system, how expired or deleted invitation codes can be used as powerful attack vectors in Vanity Invite Links,” the researchers said. “By hijacking a legal invitation link, the threat actor quietly redirects unsuspecting users to a malicious, incompatible server.”