Check Point · Published 12 Jun
From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery
By alexeybu
Excerpt
Key Takeaways
Check Point Research uncovered an active malware campaign exploiting expired and released Discord invite links. Attackers hijacked the links through vanity link registration, allowing them to silently redirect users from trusted sources to malicious servers.
The attackers combined the ClickFix phishing technique, multi-stage loaders, and time-based evasions to stealthily deliver AsyncRAT, and a customized Skuld Stealer targeting crypto wallets.
Payload delivery and data exfiltration occur excl…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt2
More from Check Point98
Check Point · Web page · Published 12 Dec
November 2023’s Most Wanted Malware: New AsyncRAT Campaign Discovered while FakeUpdates Re-Entered the Top Ten after Brief Hiatus
Researchers reported on a new AsyncRAT campaign where malicious HTML files were being used to spread the stealthy malware. Meanwhile, downloader FakeUpdates jumped straight into second place after a short break from the top ten list Our latest Global Threat…
Check Point · Web page · Published 10 Apr
The Muddy Waters of APT Attacks
The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers. Ever since at least 2017, the attackers behind…
Check Point · Web page · Published 3 Dec
Inside Akira Ransomware's Rust Experiment
Check Point Research analyzed the construction and control flow of Akira ransomware’s Rust version that circulated in early 2024, which has specific features uniquely targeting ESXi server. Our analysis demonstrates how Rust idioms, boilerplate code, and…
Check Point · Web page · Published 13 Jan
Unveiling VoidLink - A Stealthy, Cloud-Native Linux Malware Framework
VoidLink is an advanced malware framework made up of custom loaders, implants, rootkits, and modular plugins designed to maintain long-term access to Linux systems. The framework includes multiple cloud-focused capabilities and modules, and is engineered to…
On the same topics
shaddy43.com · Web page · Added 29 Oct
Emotet Malware Analysis: VBS Dropper, Fileless X.dll and ECDH C2
Emotet is a sophisticated, modular form of malware that initially emerged as a banking Trojan in 2014 but has evolved over the years to become a highly prevalent and versatile threat. Known for its ability to deliver additional malware payloads and act as a…
jamf.com · Web page · Added 29 Oct
CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode
Jamf Threat Labs uncovers CloudSyncD, a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file. September 30 2026 by Jamf…
SOCRadar · Web page · Published 12 Oct
Inside ICMacOS: From an Infostealer to a Persistent RAT
Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an important share of the global desktop operating system market. Modern enterprise adoption has surged, particularly in the United States, where roughly…
russianpanda.com · Web page · Published 26 Dec
Pure Logs Stealer Fails to Impress
Pure Logs Stealer first appeared on hacking forums at the end of October 2022. The stealer is developed by a malware developer going under the alias PureCoder. The malware developer is also behind in developing the products shown above, such as Pure Miner,…