Discord virus

Discord virus is a type of malware that infiltrates the system via chatting application to steal personal details or passwords 

Discord virus is a set of malware distributed via the voice over internet protocol (VoIP) application Discord. The application itself is legitimate and often used by users to communicate while playing online video games, and is also popular among the security research community. Unfortunately, bad actors also create chat servers that are hosting malware.^[1] Users who get tricked into infecting their machines with Discord virus in the form of trojans or worms are putting their sensitive information at risk, as well as have an increased chance of getting infected with other malware.

Cybercriminals are also known to alter the functions of the Discord platform in a way that allows them to perform malicious activities on the host machine. Essentially, they modify the original installer and insert the malicious payload into it, which results in a Discord virus installation, and users are rarely aware of it because they think that they installed a legitimate version of the app. Spidey Bot malware spreading through this application was the more recent versions of malware targeting 250 million users all over the world.

Discord bots are also known to be great additions to various servers used by many, as they allow different functionality via commands that can be launched by regular users or server admins. Nevertheless, some bots were rumored to be causes of information stealing and hacking by using Discord – one of such cases was started by the user Cia and the KawaiiBot.^[2]

When it comes to any social media or applications, malicious actors always target users with scams and phishing attacks. Discord is no exception. For years, since the initial appearance of this social network, it was known that various messages surface the DMs (Direct Messages).

One of the most prominent examples is the so-called Discordgg.ga virus, otherwise known as Discord gg ga virus, where malicious actors promise users a free Discord Nitro subscription and redirect them to a spoofing site that harvests the login details. These are later used in a further phishing scheme that can lead to serious privacy issues.^[4]

Most of the malware that is delivered via Discord is Remote Access Trojans^[5] (RATs). These malicious applications are installed with users’ permission, although victims are not aware of it (typically phishing techniques are used to make the user click on malicious links or attachments). As soon as Discord malware is settled, it grants itself administrative rights, and the host system is used to distribute the RAT even further – that is how a botnet is established.

RATs that are common in Discord virus attacks include:

• NanoCore (Trojan.Nancrat)
• SpyRat (Backdoor.Ratenjay)
• njRAT (W32.Spyrat)
• OSX.Dummy

All the viruses mentioned above are capable of various malicious activities on the targeted PC, including monitoring the behavior of the victim, recording keystrokes, taking screenshots, using the webcam to record the video, formatting drives, starting or shutting down various system processes, as well as installing additional malicious files on the system. Before that happens, users are advised to regularly scan their machines using security software and take care of Discord virus removal if it was detected on the device.

Additionally, certain hacking tools are being advertised as legitimate. Malware authors claim that the hacking tool can allegedly steal passwords of other Discord users. However, as soon as victims agree to download the application, they become victims of a phishing attack itself and get scammed. The unfair users are then hit with malware that is capable of stealing personal information and distributing RATs even further.
Discord virus is malware that is capable of stealing sensitive information for targeted users

KawaiiBot Discord virus is a hoax, although server owners should be careful when implementing bots, as they might be used for malicious purposes

Discord’s KawaiiBot is not a virus, although recently, a heated debate was established between users of Discord, as well as safety advocates. The bot can be found on the official website hxxps://kawaiibot.xyz (it does not need to be downloaded to the machine to be functional), and its source code can be viewed via the Github platform online.

Nevertheless, the rumor of KawaiiBot virus began when a user under the name of Cia posted a highly-shared post which read:

As most of you know, a virus attacked discord a little ago and hijacked thousands of accounts. The creators of this virus are at it again, and have announced that they are going to “nuke discord” on the 27th of July.

To prevent your account from being interfered with, we strongly advise:
1. Enabling two-step authorization  in your discord settings.
2. Leaving any server you’re in that has KawaiiBot and/or banning KawaiiBot from any server you own or staff in.

The user then proceeds to talk about how the alleged Discord attack, which will be performed on the 27th of July. However, the rumor of the KawaiiBot Discord virus was quickly debunked by its developer AlexFlipnote – the bot runs on a secure server and simply does not allow the function of stealing sensitive information like login details from other users.

In fact, AlexFlipnote explained the situation in detail, that the KawaiiBot bug relied on permission settings that allowed certain unauthorized parties to use the bot to proliferate malicious links that led to malware-laden or spoofing websites (otherwise known as “Nuking Discord”).^[6] The solution to this problem is simple, server owners should always use relevant permissions – no bot should have Administrator or “Mention Everyone” access.

In other words, KawaiiBot virus does not exist; any malicious activity connected to the bot is prompted via fake links used by cybercriminals. Users can avoid Discord account compromise if they enable two-factor authentication and never provide their login information on spoofing or other phishing sites. Finally, do not be scared of using servers that use KawaiiBot – it is safe.

KawaiiBot virus is a hoax – the bot cannot be used to steal sensitive user information, while malicious links embedded via using the bot can. Therefore, server owners should always ensure to enable relevant permissions to KawaiiBot to avoid malicious actors from abusing it via the “at everyone” function

Discord Spidey Bot virus

October of 2019 came out with new reports about malware involving Discord chatting platform. New piece of malware dubbed Spidey Bot was discovered affecting Windows Discord clients with the altered code version of the application. Reports revealed that the fact about functionality derived from HTML, CSS, and JavaScript allows malware creators to modify important core files to execute malicious behavior once the real Discord is closed and the malicious one restarted instead. 

It is suspected that particular malware travels around via chats and posing as cheats for games while initially installing malicious software. It is hard to tell if you have this malware on the system since it has no distinct symptoms and doesn’t alter particular features on the machine. 

This Spidey Bot injects itself into Discord’s code and targets to steal usernames, email addresses, IP addresses, phone numbers, Discord information, payment details. Also. threat copies the last 50 characters saved in the clipboard. Unfortunately, that is the biggest issue that can pose danger to your identity and privacy because passwords, credit card credentials and similar information that may be copied there can be used in secondary scams and malicious campaigns.

The best method that helps to remove Discord malware is anti-malware tools and full system scans, but you can also check to see if the virus is running on the system. Spidey Bot mainly targets these files in the Discord folders: %AppData%\Discord\[version]\modules\discord_modules\index.js and %AppData%\Discord\[version]\modules\discord_desktop_core\index.js. Open each of those using Notepad: one line of code should be in both of them when there is more than a single code line, you can be sure that Discord build on your PC is compromised. 

Discord virus is the term used to describe various malicious campaigns spreading on this network including phishing campaigns and malware dropping.

Targets of Discord virus are usually gamers and video streamers. The latter ones often employ the program to stream gaming sessions for entertainment purposes. The hackers often target personal information that is related to online gaming, such as:

• Login credentials;
• In-game currency;
• Contacts;
• Items, etc.

This data can be used for monetary benefit in the same way it is used by hackers when they steal private information like name and surname, address, email, social media credentials, etc. (which can also be harvested by cybercriminals in the process).

As evident, these actions pose serious personal safety concerns and can result in identity theft or money loss. To make sure you are not a victim of such a consequence, better remove Discord virus as soon as possible. For that, you should install reputable security software such as Reimage Reimage Cleaner or Malwarebytes and perform a full system scan. Security researchers^[7] warn that RATs can disable anti-virus programs in some situations, so starting the computer in Safe Mode with Networking is an option.

Fake DMs prompt users to click on discordgg.ga phishing link

The campaign starts with a direct message from somebody in the friend list, which prompts users to open a fake link discordgg.ga – it seems to be connected to the Official Discord site. Unfortunately, when looking closely, you can see that this website is discord dd dot ga – a mockup of the official social network page. The phishing message claims that you can get the Discord Nitro for free, which is obviously a scam.

Unfortunately, by falling for the discordgg.ga virus, you allow scammers to obtain account information that can be used to spread the campaign further. The embed of the Discord link is forged, and the redirect leads to a site that records information. In other words, if you are receiving a link from your friend that prompts you to click on a discordgg.ga link, it means his or her account got hijacked in this exact way.

Here’s what the phishing message from discord gg ga virus looks like:

Yo, friend gave me a referral link to get Discrod nitro for free
https://discordgg.ga/nitro/redeem/nA94n19amD9a4
It worked on my alt, but you can only apply one per IP So try it out 🙂
If you already have nitro it will give you the next month free

Once the malicious link is clicked, it brings you to the spoofing site,^[8] which asks you to enter their login information to receive the Discord Nitro for free allegedly. Hackers then lock you out of the profile and can DM other server members, group chats with all the malicious links. You can make a new account and try to inform as many people in your circle to let them know about the phishing campaign.

You can attempt to log out these people from the account by changing the password and enabling the two-way-authentication. Don’t fall for the scam when you receive a message from a friend or a person you know and inform that friend has a virus and a compromised account.

Although the Discordgg.ga domain got banned by the company itself; this campaign might repeat itself via other malicious sites. Keep the machine clean from such threats and eliminate damage by scanning the system with Reimage Reimage Cleaner . You can use other tools, base the selection on the malware detection rate.^[9]

Discord virus is the threat that delivers possibly malicious links in DMs and infects the system further if clicked or not terminated in time.

Discord – a chat program that rapidly gained popularity

Many users used chatting programs since mIRC and ICQ times, later turning to Skype and Facebook messenger. Gamers used TeamSpeak, Mumble, and Ventrilo for their communications, but often required players to share various IP addresses and/or were not free to use and were resource-heavy, which is a huge disadvantage when playing games. 

Thus, Discord was created in 2015 as an alternative VoIP application that is lightweight, innovative and user-friendly. Additionally, it was supported on multiple platforms, including Windows, Android, macOS, iOS, Linux and web browsers. The simplicity of Discord is what added to its popularity, as any user can create a server or a group in just a few seconds. Thus, the popularity of the app grew, and by May 2018, it was used by 130 million users worldwide.

Unfortunately, bad actors reacted to the booming fame of the app and were well prepared to use Discord malware for their malicious deeds. While some criminals hosted viruses on the created servers, others use the platform as an alternative to the black marked on Dark Web and sell sensitive information or malware.

Ways Discord virus is distributed

Discord users can upload files like pictures, videos, and other attachments on the application using the chat feature. Since the app allows anybody to upload almost all kinds of data, malware authors can use the feature to their advantage. While the Discord team applied additional security measures over time, Discord malware is still prevalent and should be taken seriously.

Discord, being one of the most popular chat apps around, has also grabbed attention of malicious actors who are trying to steal login credentials from users and lock them out of their accounts

Users are merely baited to open the malicious attachments in sophisticated phishing attacks via the chat function on the created servers. Some attackers don’t even have to create their own servers, as they can manually post the virus on the server they have been invited to.

To avoid dangerous consequences of the data-harvesting malware, users should never click on suspicious links in chats, even if they are coming from people on their friend list. Users reported that certain instant invite messages were turned into malicious links without their knowledge.

Remove Discord virus from your computer

To remove Discord virus from your computer, you will have to employ reputable security software. Remote Access Trojans often use obfuscation techniques and show no symptoms of presence whatsoever. Therefore, detecting malware without using professional tools might be impossible. 

Download Reimage Reimage Cleaner , SpyHunter 5Combo Cleaner or Malwarebytes for the effective Discord virus removal. Make sure that the security software is up to date before performing the scan. In case the malicious software prevents you to start anti-virus correctly, enter Safe Mode with Networking as explained below.