Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
The sample called itself InfernoGrabber and was built as a Discord themed avatar upscaler, though its true purpose was to steal and lock personal files.
In a single front-end, the generated code assembled routines and stubs for keylogging... In this sample, the keylogger observes keystrokes only while the user interacts with the page.
In this sample, the 'desktop screenshot' routine captures the rendered web page.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Browser-based malware sample masquerading as an AI avatar-enhancement service for Discord. It was designed to steal Discord tokens, payment-card and cryptocurrency-wallet data, log input, surveil victims, and encrypt files for ransom. The article emphasizes that many capabilities were nonfunctional due to browser sandboxing, but a realistic attack path using the File System Access API could read, exfiltrate, and encrypt files in a user-selected directory.
An AI-generated browser-based malware sample disguised as a Discord-themed AI avatar/photo upscaler. It abuses Chrome's File System Access API on Android to obtain user-approved folder access, silently encrypt files in photo directories, display a Bitcoin ransom note, and threaten data leakage.
An AI-generated browser-native malware scaffold disguised as a Discord avatar AI upscaler. It attempts to use the File System Access API to obtain user-approved access to local folders, enumerate files, exfiltrate contents, and encrypt/overwrite files while displaying a ransom-style message. Much of the broader stealer functionality is incomplete or hallucinatory, but the file-access and ransomware workflow is practical.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.