Discord bots are being used in information-stealing campaigns

Smartphone with the Discord social gaming platform logo on the screen in a clenched hand on the background of Discord logos
(Image credit: Shutterstock / Sergei Elagin)

Hackers have been observed using Discord to grab data harvested on compromised computers, experts have warned.

In a new report, Trellix cybersecurity researcher Gurumoorthi Ramanathan detailed the malware and the data exfiltration techniques it used. 

According to the report, the threat actors built a sophisticated infostealer called NS-STEALER. They’re distributing it via ZIP archives impersonating cracked software. When a victim extracts the archive file, they will find a Windows shortcut titled “Loader GAYve” which, if executed, will deploy a malicious Java program. This program will do two things: first it will create a folder called "NS-<11-digit_random_number>", to which it will store all of the information harvested. Then, it will start grabbing the data.

Cost-effective data exfiltration

NS-STEALER will look for information stored in more than two dozen browsers - cookies, credentials, and autofill data. Then, it will start taking screenshots of the infected device, grabbing system information, and the list of programs installed on the device. It will then pull Discord tokens, as well as Steam, and Telegram session data. 

Finally, it will exfiltrate all of the above to a Discord Bot channel. 

"Considering the highly sophisticated function of gathering sensitive information and using X509Certificate for supporting authentication, this malware can quickly steal information from the victim systems with [Java Runtime Environment]," Ramanathan said.

“The Discord bot channel as an EventListener for receiving exfiltrated data is also cost-effective."

This is hardly the first time hackers found a way to abuse Discord for their nefarious purposes. In fact, Discord has been abused for years now. Back in 2020, researchers from MalwareHunterTeam found a remote access trojan (RAT) that used Discord as a command and control (C2) server. That same year, researchers saw a version of the AnarchyGrabber trojan used to steal victims’ plain text passwords and even command an infected client to spread malware to their Discord friends.

More from TechRadar Pro

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.
Microsoft Teams and other Windows tools hijacked to hack corporate networks
An American flag flying outside the US Capitol building against a blue sky
US military and defense contractors hit with Infostealer malware
Hands typing on a keyboard surrounded by security icons
Infostealers on the rise: the latest concern for organizational defenses
A white padlock on a dark digital background.
GitHub is hiding malware disguised as games, legitimate software
Trojan
Hackers hide malware into website images to go unnoticed
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Microsoft reveals over a million PCs hit by malvertising campaign
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
Buzz Lightyear Space Ranger Spin Rennovations
Disney’s giving a classic Buzz Lightyear ride a tech overhaul – here's everything you need to know
Hisense U8 series TV on wall in living room
Hisense announces 2025 mini-LED TV lineup, with screen sizes up to 100 inches – and a surprising smart TV switch
Nintendo Music teaser art
Nintendo Music expands its library with songs from Kirby and the Forgotten Land and Tetris
Opera AI Tabs
Opera's new AI feature brings order to your browser tab chaos
An image of Pro-Ject&#039;s Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
The iPhone 16 Pro on a grey background
iPhone 17 Pro tipped to get 8K video recording – but I want these 3 video features instead