#Discord attachment downloader download#

“It then sends them as a chat message back to the attacker via a webhook URL.” continues the report. TroubleGrabber payloads steal victims’ credentials, including system information, IP address, web browser passwords, and tokens. The TroubleGrabber attack kill chain leverages both Discord and Github as repository for next stage payloads that is downloaded to the C:/temp folder once a victim is infected with the malware. “Figure 1 shows a breakdown of the top five detections of 1,650 malware samples from the same time period that were delivered from Discord and also contained Discord URLs.” At the same time, we scanned our malware database for samples containing Discord URLs used as next stage payloads or C2’s.” reads the report published by NetSkope. “In October 2020 alone, we identified more than 5,700 public Discord attachment URLs hosting malicious content, mostly in the form of Windows executable files and archives. The experts identified more than 5,700 public Discord attachment URLs hosting malware. Netskope researchers discovered TroubleGrabber in October 2020 while analyzing Discord threats. The info stealer was also distributed among Discord users from over 700 different Discord server channel IDs.

#Discord attachment downloader download#

The malware was distributed via Discord in 97.8% of detected infections, “with small numbers distributed via and anonymousfiles.io, services that allow users to upload files anonymously and free for generating a public download link.” The malware sends information back to the attacker via webhook as a chat message to his Discord server. This malware is distributed via drive-by download, it is able to steal web browser tokens, Discord webhook tokens, web browser passwords, and system information. TroubleGrabber was developed by an individual named “Itroublve” and is currently used by multiple threat actors.

The malware the same functionalities used by other malware that target Discord gamers, like AnarchyGrabber, but it appears to be the work of different threat actors.