Discord Turned Into an Account Stealer by Updated Malware

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/discord-turned-into-an-account-stealer-by-updated-malware/

A new version of the popular AnarchyGrabber Discord malware has been released that modifies the Discord client files so that it can evade detection and steal user accounts every time someone logs into the chat service.

AnarchyGrabber is a popular malware distributed on hacking forums and in YouTube videos that steals user tokens for a logged-in Discord user when the malware is executed.

These user tokens are then uploaded back to a Discord channel under the attacker's control where they can be collected and used by the threat actor to log in as their victims.

The original version of the malware is in the form of an executable that is easily detected by security software and only steals tokens while it is running.

To make it harder to detect by antivirus software and to offer persistence, a threat actor has updated the AnarchyGrabber malware so it modifies the JavaScript files used by the Discord client to inject its code every time it runs. [....]

MalwareHunterTeam, who found this new variant and shared it with us, told BleepingComputer that "skids are sharing them everywhere."

What makes these Discord client modifications such a problem is that even if the original malware executable is detected, the client files will be modified already.

As security software does such a poor job detecting these client modifications, the code will stay resident on the machine without the user even knowing their accounts are being stolen.

 

[CyberTech]

Discord client turned into a password stealer by updated malware

A threat actor converted the AnarchyGrabber trojan into a new malware that steals passwords and user tokens, disables 2FA, and spreads malware to a victim's friends.

www.bleepingcomputer.com

If you use Discord please read this article its important!

 

[SumTingWong]

Discord client turned into a password stealer by updated malware

A threat actor converted the AnarchyGrabber trojan into a new malware that steals passwords and user tokens, disables 2FA, and spreads malware to a victim's friends.

www.bleepingcomputer.com

If you use Discord please read this article its important!

I'm safe! Good thing is I disable autoupdate and haven't used it for the last 2 or 3 weeks now. GONNA UNINSTALL IT!

 

[CyberTech]

Same here its safe, i dont want to uninstall it there are my friends on i hate when that happened!

 

[ErzCrz]

Another reason why I continue to just use the in browser version instead of installing it.

 

[CyberTech]

Ah i forgot that! thank you, its time to uninstall it...

 

[blackice]

I still don't understand the vector of delivery for these attacks. is it still malicious links, or chat bombing with malicious code? You could just uninstall and reinstall every time you use it.

 

[Protomartyr]

@blackice It's basically users installing things they shouldn't.

Threat actors then distribute the trojan on Discord, where they pretend it's a game cheat, hacking tool, or copyrighted software.

Once installed, past versions of the trojan modify the Discord client's JavaScript files to turn it into a malware that would steal a victim's Discord user token.

Using this stolen user token, the attacker can log in to Discord as the victim.

 

[blackice]

@blackice It's basically users installing things they shouldn't.

Ah, seems like not as big of a deal. So many of these articles make it sound like it’s magically modifying the .js file out of the blue.

 

[Protomartyr]

If you're not click happy, then you should be safe.
All the Discord servers I'm in are moderated and vet their members. However, I can see this being a problem in public discords where anyone can join in and are click happy.

 

[blackice]

If you're not click happy, then you should be safe.
All the Discord servers I'm in are moderated and vet their members. However, I can see this being a problem in public discords where anyone can join in and are click happy.

I haven’t had discord installed since it first came out. I didn’t really use it. Definitely seems like a dangerous place for people who like to click links.

 

[CyberTech]

 

[Oten]

Good to know but has it been fixed now?
Haven't use Discord in a while. Last time i use it is for coordinating a guild war in online game.

 

[blackice]

Good to know but has it been fixed now?
Haven't use Discord in a while. Last time i use it is for coordinating a guild war in online game.

Sounds like the answer is no. Discord does not do an integrity check, which is what bleepingcomputer keeps recommending. However you have to get an infected file and execute it to become a victim of this. So it depends on what type of risky behaviors you have.