Hackers are increasingly targeting Discord to spread malware, warns Sophos

A popular chat service called Discord is being abused by cybercriminals to spread malware and target their users.

Malware increasingly targets Discord for abuse (Photo from Sophos)

Game cheating tools found in the malware?

British security software Sophos has reported that Discord became a tool for hackers globally to distribute malware. This threat includes information-stealing malware, spyware, backdoors, and ransomware

In the past two months, Sophos was able to delete and block the malware products with nearly 140 times the number of detections over the same period in 2020. Just this April, the company claimed that more than  9,500 unique URLs hosting malware on Discord’s content delivery network (CDN).

In the second quarter, Sophos was able to detect 17,000 unique URLs in Discord’s CDN pointing to malware. This can be quite alarming since millions of gamers are using Discord. As the origins of the service were tied to online gaming, Discord’s audience includes large numbers of gamers, including players of youth-oriented titles such as Fortnite, Minecraft, or Roblox.

Among the malicious files discovered by Sophos were game-cheating tools that target games that integrate with Discord, in-game. The tools may take advantage of the weaknesses in Discord’s protocols. For example, one player might crash the game of another player. Sophos senior researchers Sean Gallagher and Andrew Brandt said that that the largest percentage of the malware they found is focusing on credential and personal information theft. 

They also noted in their findings that Discord's vast user base provides an ideal environment for stealing personal information and credentials through social engineering. 

Sophos advised that consumers should install security solutions like Sophos Home on the devices they and their families use for online communications and gaming. The researcher added on their blogpost,

Discord is not the only service being abused by malware distributors and scammers by any means, and the company is responsive to take-down requests. But Discord users should remain vigilant to the threat of malicious content on the service, and defenders should never consider any traffic from a cloud service as inherently "safe" based on the legitimacy of the service itself.

Source: Sophos