Discord Invite Link Hijacking Delivers AsyncRAT and Skuld Stealer Targeting Crypto Wallets
A new malware operation is using a flaw in Discord's invitation mechanism to spread the AsyncRAT remote access trojan and the information-stealing program Skuld.
Through vanity link registration, the attackers were able to take control of the links and covertly reroute users from reliable sources to malicious servers, according to a technical report from Check Point. To covertly distribute AsyncRAT and a customized Skuld Stealer that targets cryptocurrency wallets, the attackers used a combination of time-based evasions, multi-stage loaders, and the ClickFix phishing tactic.
The problem with Discord's invite method is that it gives hackers the ability to steal invite links that have expired or been removed and covertly reroute unwary users to malicious servers that they control.
...