Topic: Discord Stealer

https://github.com/topics/discord-stealer

by _8j50 • 3 years ago

114 110 3 years ago

cobertos4• 3 years ago

Why do people go after Discord accounts so hard? They're not commonly used for OAuth into third party sites, they don't house money, and Discord makes it hard to get all the data out of an account anyway (GDPR request only returns your half of conversation, etc...). I don't understand.

Additionally, It's the only platform I've been hacked on. Someone compromised a friend's account and said they had made a game they wanted me to try (I'm an indie game dev so it seemed legit)

capableweb• 3 years ago

Most of those projects listed aren't exclusively Discord "stealers", but seems to grab a bunch of things like cookies, tokens and more.

Stagnant2• 3 years ago

Yeah "discord stealer" basically means that it is a stealer that uses discord webhooks to deliver data from the victims. "stealer" is a type of malware that typically grabs cookies and saved login data from installed browsers along with extension data such as crypto wallets.

armada651• 3 years ago

Same reason mail servers are a massive target, it's for sending out spam. People are more likely to click suspicious links if they're coming from a friend.

cobertos4• 3 years ago

Ah I forgot about Discord spam! I did used to get _a lot_ of that. Particularly surrounding crypto prpjects

Scaevolus• 3 years ago

Because hackers are mostly teens, teens are mostly on discord, and Discord accounts can have juicy private information.

adzm2• 3 years ago

It also makes it easy to spread through messages or invites etc

WXLCKNO• 3 years ago

Massive raise during the NFT boom to spam people with fake minting sites and also scam them out of their crypto in other ways.

spencerchubb• 3 years ago

super common for crypto projects to use discord as their main community and communication

yieldcrv• 3 years ago

all of your assumptions are wrong due to many crypto communities moving or spawning there and it is quite lucrative

only have to be right once and there is a huge and gullible audience there

JCharante2• 3 years ago

A lot of discord users are script kiddies or non technical users for whom Teamspeak 3, Ventrilo, Mumble, IRC, or Jabber were “too hard” to setup making them easy targets.

I’ve been a discord user since July 2015 and it was nice until people began to use it as an everything app and the hordes of children joined. I really really despise the discord userbase because they’re the new generation of the eternal September that ruins the internet.

op00to4• 3 years ago

The same reason 30 years ago we would force netsplits on IRC and hijack ops in channels.

cobertos4• 3 years ago

True... Though I've seen projects selling Discord hacking as a SaaS. And I never understood who was paying for that service and why. I also don't know enough IRC to know if hacking it was monetizable in that way

adzm2• 3 years ago

Notably, chrome locks it's cookie database to help prevent these kinds of things while the system is running

chupapimunyenyo2• 3 years ago

https://youryoure.com/?its

maxloh2• 3 years ago

Is that really the case? The Chromium documentation states the opposite.

Why aren‘t physically-local attacks in Chrome’s threat model?
We consider these attacks outside Chrome's threat model, because there is no way for Chrome (or any application) to defend against a malicious user who has managed to log into your device as you, or who can run software with the privileges of your operating system user account. Such an attacker can modify executables and DLLs, change environment variables like PATH, change configuration files, read any data your user account owns, email it to themselves, and so on. Such an attacker has total control over your device, and nothing Chrome can do would provide a serious guarantee of defense. This problem is not special to Chrome — all applications must trust the physically-local user.

https://chromium.googlesource.com/chromium/src/+/master/docs...

k4rli• 3 years ago

Maybe they only mean that it's locked while Chrome is running, but Chrome docs are about when it's closed?

Stagnant2• 3 years ago

At least passwords and cookies are encrypted with DPAPI on windows. Stealers get around it by simply decrypting the vault on the victim's machine and sending the unencrypted credentials back to attacker.

varenc• 3 years ago

Really? I use the `pycookiecheat` python package to read out the cookies from Chrome while it's running no problem. Great for automating certain private APIs that need the correct cookie to keep functioning.

jxi• 3 years ago

What's the high level of how these things work?

isoprophlex• 3 years ago

They vacuum up whatever auth tokens etc they can find in your browser, if I'm not mistaken

badrabbit10• 3 years ago

Some of the projects target only discord but others are like you siad. They steal browser login/payment/cookies crypto wallet, password manager dbs and a whole lot more. They then sell this info to whoever wants to pay for it on criminal chats and forums.

These are open source but the popular ones are paid malware (as cheap as a few dollars though) you get on those same forums/chats that have more features, evasiveness and nice control panels. But arguably, discord is a nice enough control panel lol.

indiv0• 3 years ago

A buddy of mine got hit by one of these recently. He got a message from a friend asking him to try a demo of new video game. His friend is a video game developer so this didn't seem suspicious. The "video game" had a landing page and everything. Turns out that his friend's account had already been hacked and the "video game" was a stealer like this. TL;DR: he lost his account and that same hacker tried to get me with the same scheme.

Discord support has been completely unhelpful, because he didn't have 2FA enabled before and the hacker added it.

jquery2• 3 years ago

"oops I got hacked when I hacked and/or tried to hack you" is a pretty old trick... I would be cautious about this friend.

At least it was just discord. I'd treat this as a valuable lesson on the virtue of 2FA especially if they have a habit of running untrusted executables (especially with admin permissions...)

jrockway• 3 years ago

I don't think you should feel safe just because you have 2FA enabled. Local malware can wait until the next time you have to provide your second factor, and then use it to disable 2FA, etc.

My main takeaway from looking at some of the repositories is that they are deathly afraid of being run in a VM, because they think that means someone is trying to reverse engineer them. (Which I suppose makes sense; test untrusted software in a VM, if it doesn't do anything evil, then run it outside of the VM.)

chupapimunyenyo2• 3 years ago

2FA doesn't work on discord if they have your token, and that's what the stealers grab

jpbastyr• 3 years ago

I think they just mean that recovering the account post-compromise was not possible because they didn't have 2fa already setup to authorize them as the true owner of the account, not that 2fa would've prevented the issue

DrawTR5• 3 years ago

Interesting how malware is essentially allowed on GitHub, seeing as the top result here has ~500 stars and has features advertised to steal much more than Discord accounts. I have a recollection of downloading a program from GitHub (which has 1.4k stars right now) whose installer had an opt-out malware bundled -- I reported the repo three times, and they didn't take any action. Chocolatey team did step in and remove it on their platform, but I wonder why GitHub didn't take any action

creatonez• 3 years ago

I would differentiate 'malware implementations' from 'malware'. A hacking tool presented with its harmful features at face value, with adequate warnings, is not quite the same as an attempt at tricking people into downloading or bundling something dangerous. I believe Github makes the same distinction in allowing hacking tools. They also allow byte-reversed or zip-encrypted copies of well-known malware for the purpose of study. There's no way to keep out the bad guys while still allowing security researchers.

DrawTR5• 3 years ago

I would understand the first definition if not for the fact that these pieces of software under the topic really don't have any legitimate usage in my opinion. Unless you're explicitly making the argument that the code is the important part (& should be kept on GitHub for the purpose of disseminating the programming methods used to create it, despite their purpose), I just think that GH is being used as a 'download link' if not an aggregator for projects like these. And, they're used for the express purpose of infecting other machines, presumably of people who are none the wiser

elj2• 3 years ago

I would draw the line at the malware author helping users of it use stolen data: https://github.com/Blank-c/Blank-Grabber/issues/359

jrm4• 3 years ago

I'm glad they don't?

That's one of the perks of free/open source.

Presuming there exists something like a provider/customer relationship for users of Discord, it's now Discord's job to step up and fix it; unfortunately years of Microsoft getting away with horrible security has cemented in our collective heads that "malware" is some abstract thing that, you know, just happens.

rplnt• 3 years ago

The interesting part is Github regularly takes down software that could aid someone to break copyright of one of the few big media companies.

WendyTheWillow• 3 years ago

Ehhh, I would hesitate before blindly believing the claims you see on these repos. It's easy to say stuff like that in a README.md, and maybe at one point it was true, but these are literally thieves, so... take it with a grain of salt.

inspector14• 3 years ago

Especially considering the fact that there are discussions in the issues in these repos from the codeowners who "don't condone illegal activity" actively providing guidance on how to use the stolen data to login to victim's accounts on various services.

andreareina• 3 years ago

This is the other side of allowing ytdl, revanced etc (absent a legal order).

DrawTR5• 3 years ago

I mean -- I think my main point here, and to the other commenters who are saying "I'm happy that they don't take things like this down" -- is that I think the dynamic shifts a little bit when the point of the project, the explicit reason for its creation is malicious, & the entire point of it existing on the platform is for other people to use it maliciously

matheusmoreira• 3 years ago

I'm glad they don't. I like knowing what's out there. I get to see the source code, understand how I could be attacked and implement countermeasures.

bl4kers• 3 years ago

Fun fact: Discord has a 5-year-old feature request to add support for a 24-hour clock (the global standard). Apparently it doesn't show up on their dashboard because it's "answered" even though the answer is "switch to English UK if you want that"

https://support.discord.com/hc/en-us/community/posts/3600300...

flashback2199• 3 years ago

Trying to find the fun here..

hypeatei• 3 years ago

It's very annoying how long it's taking them to figure this out.

It should just follow what the system is doing like other apps.

alexvitkov5• 3 years ago

From a glance, none of these exploit vulnerabilities in Discord/Telegram, they'te just garbage you have to convince someone to run. There's nothing to be learned from their source code, no legitimate action the companies can really take to improve their software and stop this and no way to use the software for anything other than trying to ruin someone's life.

If you want to go ahead and make the free speech argument, feel free, but I don't buy it.

"This repository is for ethical purposes and to use the scripts to learn and improve in python :)"

emsign2• 3 years ago

People who use this or program it for others to use in the wild are human garbage and should be socially isolated, it's as simple as that. It's their moral choice and when they choose malice, they will have to be morally judged. To the least.

vasdae4• 3 years ago

Calm down friend, it's just a program that steals a chat room.

axegon_2• 3 years ago

You are right. That is not to say that discord has a ton of security issues. For example, thousands of people, myself included have been screaming from the top of our lungs for years that sending files over discord creates public links that anyone can access and yet that issue was never addressed.

ShamelessC• 3 years ago

Didn’t they just announce changes that will force URL’s to expire after some time?

oasisaimlessly• 3 years ago

'Creating public links' isn't a security threat if the URLs have enough entropy to be unguessable.

yellow_lead• 3 years ago

For some context, a 'stealer' usually looks for saved credentials on your computer, browsers, disk, etc, and sends them to the hacker. Like others said, an exe that you have to run to be affected.

codedokode2• 3 years ago

Usually stealer is run by the attacker after using some vulnerability on Windows, or packed with pirated software and run by the user.

badrabbit10• 3 years ago

The most common way is for users to just download and execute it from a website or in an archive over email. No vulnerability exploitation needed, the guys that actually use vulns install a rat in addition to stealers and sell access to the computer/network.

skrebbel5• 3 years ago

The top hit has stuff like this on its readme:

Over the past year, we've worked together to build and improve this project. It has been an incredible journey, and I'm immensely grateful for all the contributions, feedback, and support from each one of you.

It has been an incredible journey doing crime together with y’all. Huggles and fuzzies! ^_^

I simply don't understand that vibe. I guess I’m just old cause back in my days, the crime geeks openly did was warez and that seems substantially less evil to me. This software is explicitly intended to victimize individual users. I simply don’t get how someone can get so “incredible journey” about that sort of stuff, you active worked to make the world worse.

hutzlibu4• 3 years ago

Oh, but their disclaimer says, they don't do crime: \s

"Disclaimer: This program is provided for educational and research purposes only. The creator of this program does not condone or support any illegal or malicious activity"

I guess it is a gang like mindset. Exploiting others and preying on the weak. And I am not that old, but I actually also do remember other and more dark hack activity from the past, than just warez.

skrebbel5• 3 years ago

Sure, people were doing it, but they weren’t pretending it was a good thing on public github repos.

praash• 3 years ago

That guy is literally providing technical support in GH issues. No way. People complain about logging into stolen accounts and the developer is happy to help. There's a pinned page on how to disinfect your system, accompanied with a vibe of "should've been more careful, idiot!"

Seeing this happy-OSS-community praise from someone providing a turn-key malware solution for even the most technologically incompetent jerks is just harrowing.

vasdae4• 3 years ago

Got hacked by Blank Grabber? Well, you should have taken care before downloading/opening suspicious files.

He's not wrong.

127• 3 years ago

Crime is usually more effective if you shroud it in a cloud of gaslighting.

op00to4• 3 years ago

Back in the before times, the crime geeks openly did was credit card fraud, phreaking, etc.

asia92• 3 years ago

I mean, there are tons of immoral projects on GitHub. Check out the ones that bypass ads on YouTube

skrebbel5• 3 years ago

How is that even remotely in the same league?

JCharante2• 3 years ago

Read the feature list of the first project. Blank-Grabber just sounds so dastardly!

Topic: Discord Stealer

Related Stories