Malware Operators Abuse Discord CDN and APIs for Delivery and C2

Sophos reported that malware operators are increasingly abusing Discord’s CDN, APIs, and webhooks to host payloads, manage command-and-control, and exfiltrate stolen data. The researchers identified more than 9,500 unique malicious Discord CDN URLs in April and 17,000 unique malware URLs during the second quarter, with more than 4,700 still active shortly before publication. Prior telemetry cited in the report found Discord accounted for 4% of TLS-protected malware downloads, while 20% of malware TLS traffic involved legitimate online services, underscoring how attackers are blending into trusted platforms.

The malicious content included credential stealers, RATs, ransomware, Android malware, droppers, spyware, backdoors, and game-themed lures such as fake cheats and cracked software. Sophos said the most common campaigns targeted Discord OAuth tokens and other credentials to hijack accounts and spread additional scams, while some samples disabled security tools or fetched secondary payloads. The report also identified 58 unique malicious Android apps and 205 Discord-hosted APK URLs, including banking Trojans, and concluded that Discord remains an attractive abuse channel because its infrastructure is free, globally available, and widely trusted, despite the company removing many reported files after takedown requests.