RedTiger Infostealer Weaponizes Python Red-Teaming Tool to Hack Discord Accounts and Steal Crypto Wallets

Netskope Threat Labs has discovered a rapidly spreading Python-based infostealer named RedTiger, repurposed from an open-source red-teaming tool to target Discord users, gamers, and cryptocurrency wallets, with the malware released publicly in 2024. According to Netskope researchers, RedTiger bundles network scanning, OSINT, phishing-related toolkits, an infostealer and Discord-related tools, and attackers are now weaponising its infostealer component for criminal purposes.

The campaign’s primary victims are Discord users and gamers, with samples targeting French-speaking users and gaming-related filenames. Once executed, the infostealer injects custom JavaScript into the Discord client to intercept tokens, payment data, and authentication updates, and it even continues to monitor Discord traffic if victims change credentials.

It exfiltrates data via a two-stage process, archiving stolen data to GoFile and sending the download link and victim details to the attacker through a Discord webhook. RedTiger is cross‑platform, but persistence and automation are strongest on Windows, where it adds the payload to the startup folder, while Linux and Darwin deployment is incomplete; it also spawns hundreds of files and processes to overwhelm systems and evade detection.