8 ms·
Topic: Discord Stealer
- yellow_lead 3y agoFor some context, a 'stealer' usually looks for saved credentials on your computer, browsers, disk, etc, and sends them to the hacker. Like others said, an exe that you have to run to be affected.
- codedokode 3y agoUsually stealer is run by the attacker after using some vulnerability on Windows, or packed with pirated software and run by the user.
- _8j50 3y agoThe most common way is for users to just download and execute it from a website or in an archive over email. No vulnerability exploitation needed, the guys that actually use vulns install a rat in addition to stealers and sell access to the computer/network.
- cobertos 3y agoWhy do people go after Discord accounts so hard? They're not commonly used for OAuth into third party sites, they don't house money, and Discord makes it hard to get all the data out of an account anyway (GDPR request only returns your half of conversation, etc...). I don't understand. Additionally, It's the only platform I've been hacked on. Someone compromised a friend's account and said they had made a game they wanted me to try (I'm an indie game dev so it seemed legit)
- capableweb 3y agoMost of those projects listed aren't exclusively Discord "stealers", but seems to grab a bunch of things like cookies, tokens and more.
- Stagnant 3y agoYeah "discord stealer" basically means that it is a stealer that uses discord webhooks to deliver data from the victims. "stealer" is a type of malware that typically grabs cookies and saved login data from installed browsers along with extension data such as crypto wallets.
- adzm 3y agoIt also makes it easy to spread through messages or invites etc
- armada651 3y agoSame reason mail servers are a massive target, it's for sending out spam. People are more likely to click suspicious links if they're coming from a friend.
- cobertos 3y agoAh I forgot about Discord spam! I did used to get _a lot_ of that. Particularly surrounding crypto prpjects
- askiiart 3y agoYeah, I've gotten my fair share of that. Though now it's more common for me to get fans.ly links and the like.
- cobertos 3y agoI'm glad Ive avoided that somehow, it stopped after the crypto spam stopped a year ago. Mostly after leaving a couple bigger servers.
- pndy 3y agoHaven't got a single spam in all these years I'm using it - guess it all depends on the servers you're on
- Scaevolus 3y agoBecause hackers are mostly teens, teens are mostly on discord, and Discord accounts can have juicy private information.
- WXLCKNO 3y agoMassive raise during the NFT boom to spam people with fake minting sites and also scam them out of their crypto in other ways.
- spencerchubb 3y agosuper common for crypto projects to use discord as their main community and communication
- yieldcrv 3y agoall of your assumptions are wrong due to many crypto communities moving or spawning there and it is quite lucrative only have to be right once and there is a huge and gullible audience there
- JCharante 3y agoA lot of discord users are script kiddies or non technical users for whom Teamspeak 3, Ventrilo, Mumble, IRC, or Jabber were “too hard” to setup making them easy targets. I’ve been a discord user since July 2015 and it was nice until people began to use it as an everything app and the hordes of children joined. I really really despise the discord userbase because they’re the new generation of the eternal September that ruins the internet.
- op00to 3y agoThe same reason 30 years ago we would force netsplits on IRC and hijack ops in channels.
- adzm 3y agoNotably, chrome locks it's cookie database to help prevent these kinds of things while the system is running
- varenc 3y agoReally? I use the `pycookiecheat` python package to read out the cookies from Chrome while it's running no problem. Great for automating certain private APIs that need the correct cookie to keep functioning.
- chupapimunyenyo 3y agohttps://youryoure.com/?its https://youryoure.com/?its
- maxloh 3y agoIs that really the case? The Chromium documentation states the opposite. > Why aren‘t physically-local attacks in Chrome’s threat model? > We consider these attacks outside Chrome's threat model, because there is no way for Chrome (or any application) to defend against a malicious user who has managed to log into your device as you, or who can run software with the privileges of your operating system user account. Such an attacker can modify executables and DLLs, change environment variables like PATH, change configuration files, read any data your user account owns, email it to themselves, and so on. Such an attacker has total control over your device, and nothing Chrome can do would provide a serious guarantee of defense. This problem is not special to Chrome — all applications must trust the physically-local user. https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model https://chromium.googlesource.com/chromium/src/+/master/docs...
- jxi 3y agoWhat's the high level of how these things work?
- isoprophlex 3y agoThey vacuum up whatever auth tokens etc they can find in your browser, if I'm not mistaken
- _8j50 3y agoSome of the projects target only discord but others are like you siad. They steal browser login/payment/cookies crypto wallet, password manager dbs and a whole lot more. They then sell this info to whoever wants to pay for it on criminal chats and forums. These are open source but the popular ones are paid malware (as cheap as a few dollars though) you get on those same forums/chats that have more features, evasiveness and nice control panels. But arguably, discord is a nice enough control panel lol.
- indiv0 3y agoA buddy of mine got hit by one of these recently. He got a message from a friend asking him to try a demo of new video game. His friend is a video game developer so this didn't seem suspicious. The "video game" had a landing page and everything. Turns out that his friend's account had already been hacked and the "video game" was a stealer like this. TL;DR: he lost his account and that same hacker tried to get me with the same scheme. Discord support has been completely unhelpful, because he didn't have 2FA enabled before and the hacker added it.
- jquery 3y ago"oops I got hacked when I hacked and/or tried to hack you" is a pretty old trick... I would be cautious about this friend. At least it was just discord. I'd treat this as a valuable lesson on the virtue of 2FA especially if they have a habit of running untrusted executables (especially with admin permissions...)
- jrockway 3y agoI don't think you should feel safe just because you have 2FA enabled. Local malware can wait until the next time you have to provide your second factor, and then use it to disable 2FA, etc. My main takeaway from looking at some of the repositories is that they are deathly afraid of being run in a VM, because they think that means someone is trying to reverse engineer them. (Which I suppose makes sense; test untrusted software in a VM, if it doesn't do anything evil, then run it outside of the VM.)
- jquery 3y agoAt the end of the day, running local exes is about trust. Having 2FA enabled reduces the attack surface you have exposed, even if it doesn't eliminate it as you point out.
- chupapimunyenyo 3y ago2FA doesn't work on discord if they have your token, and that's what the stealers grab
- DrawTR 3y agoInteresting how malware is essentially allowed on GitHub, seeing as the top result here has ~500 stars and has features advertised to steal much more than Discord accounts. I have a recollection of downloading a program from GitHub (which has 1.4k stars right now) whose installer had an opt-out malware bundled -- I reported the repo three times, and they didn't take any action. Chocolatey team did step in and remove it on their platform, but I wonder why GitHub didn't take any action
- andreareina 3y agoThis is the other side of allowing ytdl, revanced etc (absent a legal order).
- DrawTR 3y agoI mean -- I think my main point here, and to the other commenters who are saying "I'm happy that they don't take things like this down" -- is that I think the dynamic shifts a little bit when the point of the project, the explicit reason for its creation is malicious, & the entire point of it existing on the platform is for other people to use it maliciously
- chatmasta 3y agoThe code will continue to exist regardless of whether you see it on GitHub. Script kiddies can just as easily share the source code or binary in a zip file on a forum somewhere, or even on Discord. All you'd accomplish by removing it from GitHub is adding a censorship layer where some GitHub employee or algorithm now needs to determine what's "allowed" on the site. Are you sure you want that? Even before considering the deleterious effects of censorship, it would simply be more work for everyone and unlikely to benefit anyone. Not to mention you'd lose valuable telemetry that could be used in investigations after the fact (e.g. if someone is accused of stealing photos from an ex on discord, and GitHub can positively identify them as having downloaded a malicious tool to steal Discord tokens, then investigators could subpoena GitHub for those download records). If there is a problem here, then hiding the code that exploits the problem does not eliminate it. It's Discord's responsibility to mitigate the scale of risk associated with a stolen token. A program that grabs a token on your machine probably shouldn't be able to use it to exfiltrate all the data from your Discord account. And similarly, it probably shouldn't be so easy for any program running on the machine (as a non-root user) to retrieve such a token in the first place.
- bl4kers 3y agoFun fact: Discord has a 5-year-old feature request to add support for a 24-hour clock (the global standard). Apparently it doesn't show up on their dashboard because it's "answered" even though the answer is "switch to English UK if you want that" https://support.discord.com/hc/en-us/community/posts/360030081431-Make-the-time-format-24hr-time-clock https://support.discord.com/hc/en-us/community/posts/3600300...
- flashback2199 3y agoTrying to find the fun here..
- hypeatei 3y agoIt's very annoying how long it's taking them to figure this out. It should just follow what the system is doing like other apps.
- alexvitkov 3y agoFrom a glance, none of these exploit vulnerabilities in Discord/Telegram, they'te just garbage you have to convince someone to run. There's nothing to be learned from their source code, no legitimate action the companies can really take to improve their software and stop this and no way to use the software for anything other than trying to ruin someone's life. If you want to go ahead and make the free speech argument, feel free, but I don't buy it. "This repository is for ethical purposes and to use the scripts to learn and improve in python :)"
- emsign 3y agoPeople who use this or program it for others to use in the wild are human garbage and should be socially isolated, it's as simple as that. It's their moral choice and when they choose malice, they will have to be morally judged. To the least.
- vasdae 3y agoCalm down friend, it's just a program that steals a chat room.
- alexvitkov 3y agoa few of these steal credit cards as well. but that's ok because it can be used for good - you can learn where chrome stores its cookies!
- Modified3019 3y agoIt's a mix. The top result is https://github.com/Blank-c/Blank-Grabber https://github.com/Blank-c/Blank-Grabber, which is full fat malware, which uses discord to exfiltrate the stolen data. # Features • GUI Builder. • UAC Bypass. • Custom Icon. • Runs On Startup. • Disables Windows Defender. • Anti-VM. • Blocks AV-Related Sites. • Melt Stub. • Fake Error. • EXE Binder. • File Pumper. • Obfuscated Code. • Discord Injection. • Steals Discord Tokens. • Steals Steam Session. • Steals Epic Session. • Steals Uplay Session. • Steals Passwords From Many Browsers. • Steals Cookies From Many Browsers. • Steals History From Many Browsers. • Steals Autofills From Many Browsers. • Steals Minecraft Session Files. • Steals Telegram Session Files. • Steals Crypto Wallets. • Steals Roblox Cookies. • Steals Growtopia Session. • Steals IP Information. • Steals System Info. • Steals Saved Wifi Passwords. • Steals Common Files. • Captures Screenshot. • Captures Webcam Image. • Sends All Data Through Discord Webhooks/Telegram Bot. (...more) Others like: https://github.com/venaxyt/Token-Grabber-Advanced https://github.com/venaxyt/Token-Grabber-Advanced are intended for stealing discord information.
- skrebbel 3y agoThe top hit has stuff like this on its readme: > Over the past year, we've worked together to build and improve this project. It has been an incredible journey, and I'm immensely grateful for all the contributions, feedback, and support from each one of you. It has been an incredible journey doing crime together with y’all. Huggles and fuzzies! ^_^ I simply don't understand that vibe. I guess I’m just old cause back in my days, the crime geeks openly did was warez and that seems substantially less evil to me. This software is explicitly intended to victimize individual users. I simply don’t get how someone can get so “incredible journey” about that sort of stuff, you active worked to make the world worse.
- 127 3y agoCrime is usually more effective if you shroud it in a cloud of gaslighting.
- hutzlibu 3y agoOh, but their disclaimer says, they don't do crime: \s "Disclaimer: This program is provided for educational and research purposes only. The creator of this program does not condone or support any illegal or malicious activity" I guess it is a gang like mindset. Exploiting others and preying on the weak. And I am not that old, but I actually also do remember other and more dark hack activity from the past, than just warez.
- JCharante 3y agoRead the feature list of the first project. Blank-Grabber just sounds so dastardly!