Hackers have been observed using Discord to grab data harvested on compromised computers, experts have warned.
In a new report, Trellix cybersecurity researcher Gurumoorthi Ramanathan detailed the malware and the data exfiltration techniques it used.
According to the report, the threat actors built a sophisticated infostealer called NSSTEALER. They’re distributing it via ZIP archives impersonating cracked software. When a victim extracts the archive file, they will find a Windows shortcut titled “Loader GAYve” which, if executed, will deploy a malicious Java program. This program will do two things: first it will create a folder called “NS<11digit_random_number>”, to which it will store all of the information harvested. Then, it will start grabbing the data.
Costeffective data exfiltration
NSSTEALER will look for information stored in more than two dozen browsers cookies, credentials, and autofill data. Then, it will start taking screenshots of the infected device, grabbing system information, and the list of programs installed on the device. It will then pull Discord tokens, as well as Steam, and Telegram session data.
Finally, it will exfiltrate all of the above to a Discord Bot channel.
“Considering the highly sophisticated function of gathering sensitive information and using X509Certificate for supporting authentication, this malware can quickly steal information from the victim systems with [Java Runtime Environment],” Ramanathan said.
“The Discord bot channel as an EventListener for receiving exfiltrated data is also costeffective.”