From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery

MITRE Techniques

• [T1566] Phishing – Attackers use hijacked Discord invite links combined with a ClickFix phishing technique to deceive users into executing malicious PowerShell commands (‘ClickFix phishing technique, a fake Google CAPTCHA… prompting the user to open Windows Run dialog and execute a command’).
• [T1204] User Execution – Social engineering is employed to trick victims to run a malicious PowerShell command that downloads malware (‘Clicking “Verify” silently copies a malicious PowerShell command to the clipboard’).
• [T1041] Exfiltration Over C2 Channel – Skuld Stealer exfiltrates collected data via Discord webhooks, a one-way communication method used as command and control (‘Skuld sends collected data through a Discord webhook…’).
• [T1053] Scheduled Task/Job – Persistence and delayed execution are ensured by scheduled tasks that run malicious scripts every five minutes (‘Scheduled task named checker runs the second script runsys.vbs every 5 minutes’).
• [T1105] Ingress Tool Transfer – Downloaders retrieve payloads from trusted cloud services like GitHub, Bitbucket, and Pastebin (‘Downloads payloads using URLs from Bitbucket, GitHub, and Pastebin’).
• [T1027] Obfuscated Files or Information – Malware strings and API calls are obfuscated using XOR encryption and junk code to evade static analysis (‘Critical strings related to malicious functionality are concealed using XOR cipher and junk code’).
• [T1218] Signed Binary Proxy Execution – Use of PowerShell and Windows scripting for execution of payloads stealthily (‘PowerShell script downloads and executes malicious binaries with hidden console window’).
• [T1557] Man-in-the-Middle – HTTPS redirection and OAuth2 flows are leveraged for capturing user credentials in a phishing website mimicking Discord (‘Phishing website uses OAuth2 authentication to get user data and display fake verification’).
• [T1056] Input Capture – Skuld Stealer intercepts Discord tokens and browser credentials, as well as cryptocurrency wallet input (‘Discord injection module intercepts sensitive user operations such as login, password changes’).
• [T1083] File and Directory Discovery – Malware discovers browser versions and paths for injecting code and stealing data (‘Stealer determines the browser version using GetFileVersionInfoW for injection targeting’).
• [T1113] Screen Capture – AsyncRAT features include screen capturing capabilities (‘AsyncRAT provides keylogging and screen capturing functionality’).
• [T1624] Hide Artifacts – Malware adds exclusion paths to Windows Defender to evade detection (‘nat1.vbs script adds user directory to Defender exclusion paths’).