Discord Spy: SolyxImmortal Malware Uses Webhooks for Stealthy Theft

SolyxImmortal is a Python-based Windows information-stealing malware described as a single, self-contained package that focuses on persistence and stealth over rapid destructive action. According to CYFIRMA, it uses hardcoded webhooks on Discord for its command-and-control infrastructure, effectively exfiltrating data through trusted channels while remaining in user space to avoid triggering high-level alarms.

The malware can harvest browser credentials from Chrome, Edge, Brave, and Opera GX using Windows DPAPI, log keystrokes, capture screenshots, and search the user’s home directory for documents such as .txt, .pdf, and .docx, while filtering out files larger than 10MB. Its distribution is believed to involve an underground Telegram channel, with analysis noting a Turkish-speaking threat actor link and suggesting the activity targets opportunistic data theft rather than targeted financial campaigns.

Two distinct webhooks are used for files/logs and for screenshots, enabling real-time alerts when triggers such as visiting a banking site or typing a password occur.