Loading story…
Sophos reported that malware operators are increasingly abusing Discord’s CDN, APIs, and webhooks to host payloads, manage command-and-control, and exfiltrate stolen data. The researchers identified more than 9,500 unique malicious Discord CDN URLs in April and 17,000 unique malware URLs during the second quarter, with more than 4,700 still active shortly before publication. Prior telemetry cited in the report found Discord accounted for 4% of TLS-protected malware downloads, while 20% of malware TLS traffic involved legitimate online services, underscoring how attackers are blending into trusted platforms.
The malicious content included credential stealers, RATs, ransomware, Android malware, droppers, spyware, backdoors, and game-themed lures such as fake cheats and cracked software. Sophos said the most common campaigns targeted Discord OAuth tokens and other credentials to hijack accounts and spread additional scams, while some samples disabled security tools or fetched secondary payloads. The report also identified 58 unique malicious Android apps and 205 Discord-hosted APK URLs, including banking Trojans, and concluded that Discord remains an attractive abuse channel because its infrastructure is free, globally available, and widely trusted, despite the company removing many reported files after takedown requests.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
SophosLabs reported extensive abuse of Discord’s CDN, APIs, and webhooks by malware operators, including credential stealers, RATs, ransomware, Android malware, and game-related attack tools. The report said Discord removed many reported files and was responsive to takedown requests, but the platform remained a persistent malware distribution and C2 environment.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity researchers have uncovered a coordinated campaign in which malicious packages distributed through popular open-source repositories—npm, PyPI, and RubyGems—are being used to exfiltrate sensitive developer data using Discord webhooks as a command-and-control (C2) channel. Attackers have published several packages, such as mysql-dumpdiscord and nodejs.discord on npm, as well as malinssx, malicus, and maliinn on PyPI, and sqlcommenter_rails on RubyGems, which are designed to steal configuration files, environment variables, and host information from developer systems. These packages leverage Discord webhooks, which allow data to be sent directly to attacker-controlled Discord channels without requiring authentication or bot users, making detection and mitigation more challenging. The use of Discord webhooks is particularly insidious because webhook URLs are write-only, preventing defenders from easily auditing what data has been exfiltrated. In some cases, the malicious code is triggered during package installation, such as with 'pip install' commands, enabling the theft of sensitive information before runtime monitoring can detect the activity. The stolen data includes critical files like config.json, .env, ayarlar.js, ayarlar.json, and even system files such as '/etc/passwd' and '/etc/resolv.conf', which may contain credentials, API keys, and other secrets. By abusing Discord’s infrastructure, attackers avoid the costs and risks associated with maintaining their own C2 servers, and their traffic often blends in with legitimate communications, bypassing many firewall and monitoring solutions. The campaign highlights the ongoing risks associated with software supply chain attacks, where threat actors target developers and CI/CD environments by injecting malicious code into widely used open-source packages. Security experts warn that such attacks can have far-reaching consequences, as compromised developer machines and build systems may inadvertently propagate stolen secrets or further malicious code into downstream applications. The discovery underscores the importance of rigorous package vetting, monitoring for suspicious network activity, and the use of security tools that can detect anomalous behavior during package installation. Researchers emphasize that the abuse of Discord webhooks for C2 is a growing trend, as it offers attackers a free, scalable, and stealthy method for data exfiltration. The incident serves as a reminder for organizations to review their dependency management practices and to educate developers about the risks of installing untrusted packages. The affected repositories have been notified, and some of the malicious packages have been removed, but the ease of publishing new packages means the threat remains ongoing. This campaign demonstrates the evolving tactics of threat actors in targeting the software supply chain and the need for continuous vigilance in the open-source ecosystem. Organizations are advised to implement automated scanning of dependencies and to restrict outbound network connections from build environments where possible. The use of Discord as a C2 channel is expected to persist, given its accessibility and the difficulty of monitoring webhook-based exfiltration. Security teams should update detection rules to flag unexpected communications with Discord domains, especially from development and CI/CD systems. The incident also highlights the broader challenge of securing open-source software, where trust in package maintainers and repositories is critical but increasingly under attack.
Jun 29, 2026
Malware operators are increasingly using **TLS/HTTPS** to conceal command-and-control, payload delivery, and data exfiltration traffic, with one report finding TLS-backed malware rising from **23%** of Internet-communicating malware in 2020 to nearly **46%** in early 2021. Researchers said attackers are blending into normal encrypted traffic by abusing trusted platforms and services including **Google**, **Discord**, **Pastebin**, **GitHub**, and **Telegram**, while loaders, droppers, ransomware affiliates, and offensive tools such as **Cobalt Strike** and **Metasploit** increasingly rely on encrypted channels. Malware also frequently uses TLS on non-standard ports, reducing the value of simple port-based detection. A separate analysis of **264 malware families** found most SSL/TLS-protected malware communications used **HTTPS**, while others used **SMTP** and custom TCP protocols, and that many families relied on **self-signed certificates** or reused anomalous X.509 attributes that can expose malicious infrastructure. Researchers identified unusual subject names, abnormal serial-number lengths, invalid version fields, and suspicious validity periods as useful detection signals, while noting that some families such as **IcedID**, **AsyncRAT**, **DcRAT**, **Vawtrak**, and **PhantomNet** use certificate pinning to resist interception. The findings also show that attackers often deploy valid certificates from trusted authorities, especially **Let’s Encrypt**, underscoring that certificate metadata and anomaly-based inspection remain important for detecting encrypted malware traffic.
Aug 15, 2026
Trend Micro reported that the **Lumma Stealer** malware was being delivered through Discord’s content delivery network, using trusted infrastructure to host and spread credential-theft payloads. The campaign abused Discord CDN links to make malicious downloads appear legitimate, increasing the likelihood that users would execute the malware and allowing attackers to bypass some reputation-based defenses. Once installed, Lumma Stealer was positioned to harvest sensitive data from infected systems, including credentials and other information valuable for follow-on fraud or intrusion activity. The use of a widely trusted platform for malware hosting highlights how threat actors continue to blend malicious payload delivery into legitimate cloud and social platforms, complicating detection and response for enterprise defenders.
Jul 12, 2026