Threat Actors Abuse Discord to Push Malware

silversurfer

Super Moderator
Thread author
Verified
Top Poster
Staff Member
Malware Hunter
Aug 17, 2014
11,196
Threat actors are abusing the core features of the popular Discord digital communication platform to persistently deliver various types of malware—in particular remote access trojans (RATs) that can take over systems–putting its 150 million users at risk, researchers have found.

RiskIQ and CheckPoint both discovered multi-functional malware being sent in messages across the platform, which allows users to organize Discord servers into topic-based channels in which they can share text, image or voice files or other executables. Those files are then stored on Discord’s Content Delivery Network (CDN) servers.

Researchers warn, “many files sent across the Discord platform are malicious, pointing to a significant amount of abuse of its self-hosted CDN by actors by creating channels with the sole purpose of delivering these malicious files,” according to a report published Thursday by Team RiskIQ.

Initially Discord attracted gamers, but the platform is now being used by organizations for workplace communication. The storage of malicious files on Discord’s CDN and proliferation of malware on the platform mean that “many organizations could be allowing this bad traffic onto their network,” RiskIQ researchers wrote.

Features of the latest malware found on the platform include the capability to take screenshots, download and execute additional files, and perform keylogging, CheckPoint researchers Idan Shechter and Omer Ventura disclosed in a separate report also published Thursday.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top