But attackers also use Discord, often to distribute malicious files and steal information. Users can communicate with voice calls, chat messages, and video calls as well as send files to one another. This campaign uses Discord services to form a URL to host malicious payloads as follows: įigure 1: Malicious files blocked in the Zscaler cloud served via ĭiscord is a chat application that allows users to chat with each other in real time. It’s worth noting, however, that using Discord to host payloads is not new. The attack usually starts with spam emails in which users are tricked with legitimate-looking templates into downloading next-stage payloads.

Multiple categories of malware are being served through the Discord app’s CDN infrastructure - ransomware, stealers, and cryptominers.

File icons are also related to gaming software to trick gamers.

Malicious files are renamed as pirated software or gaming software to trick gamers.

Cybercriminals are using Discord CDN to host malicious files as well as for command-and-control (C&C) communication.

Multiple campaigns relying on the service for their infection chain.

The key findings of our research include: Recently, the Zscaler ThreatLabZ team noticed new campaigns in which cybercriminals are targeting gamers. Attackers have often exploited the popularity of certain games ( Among Us was a recent example) to lure players into downloading fake versions that served malware. People of all ages turned online for school and work, to stream videos, to play video games, have virtual get-togethers, shop, talk to their doctor, and engage in any number of other activities.ĭuring 2020, research showed a sharp increase in game downloads, and this activity did not go unnoticed by cybercriminals. Since the onset of the pandemic, the internet has become a central part of our lives.

Media discordapp