Loading story…
Cyble Research Labs reported that an upgraded Hazard Token Grabber malware strain is being used at scale to steal user data, with a primary focus on Discord users. The Python-based information stealer, first observed in 2021, has been distributed freely on GitHub while a more advanced version has been marketed through Discord and a dedicated website. Researchers said they identified more than 2,000 related samples in the wild, indicating broad circulation of the malware.
The malware establishes persistence, disables Discord token protection, and exfiltrates stolen data through Discord webhooks. In addition to Discord tokens, it targets Chrome credentials and cookies, Roblox cookies, Windows product details, geolocation data, and information from more than 20 applications and browsers. Its feature set also includes anti-debugging and anti-virtual machine checks consistent with MITRE ATT&CK T1497.001 system-check sandbox evasion techniques, helping it avoid analysis while harvesting victim data.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
The initial version of the Python-based Hazard Token Grabber stealer was observed in the wild in 2021. The malware was described as targeting user data, especially Discord-related information.
Cyble Research Labs analyzed an upgraded version of Hazard Token Grabber that was being used by threat actors at scale, with more than 2,000 related samples found during OSINT threat hunting. The research documented free distribution on GitHub, sale of an advanced version via Discord or a website, and extensive data theft and Discord webhook exfiltration capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that malware operators are increasingly abusing **Discord’s CDN, APIs, and webhooks** to host payloads, manage command-and-control, and exfiltrate stolen data. The researchers identified more than **9,500 unique malicious Discord CDN URLs** in April and **17,000 unique malware URLs** during the second quarter, with more than **4,700** still active shortly before publication. Prior telemetry cited in the report found Discord accounted for **4% of TLS-protected malware downloads**, while **20% of malware TLS traffic** involved legitimate online services, underscoring how attackers are blending into trusted platforms. The malicious content included credential stealers, RATs, ransomware, Android malware, droppers, spyware, backdoors, and game-themed lures such as fake cheats and cracked software. Sophos said the most common campaigns targeted **Discord OAuth tokens** and other credentials to hijack accounts and spread additional scams, while some samples disabled security tools or fetched secondary payloads. The report also identified **58 unique malicious Android apps** and **205 Discord-hosted APK URLs**, including banking Trojans, and concluded that Discord remains an attractive abuse channel because its infrastructure is free, globally available, and widely trusted, despite the company removing many reported files after takedown requests.
Jun 29, 2026
Threat researchers reported a new **Python-based Windows information-stealing malware** dubbed **SolyxImmortal** that emphasizes *stealth and long-term persistence* over destructive actions. The implant is described as a “monolithic” package (not modular), delivered as a legitimate-looking Python script (e.g., `Lethalcompany.py`), and runs quietly in the background to harvest sensitive data including credentials, documents, keystrokes, and screenshots. SolyxImmortal’s command-and-control and exfiltration model relies on **Discord webhooks**, abusing trusted HTTPS traffic to blend in and reduce network-based detection. Reporting attributes the analysis to **CYFIRMA**, noting that C2 parameters are hardcoded and that operators can receive real-time notifications (including via a hardcoded Discord user ID) for high-value events; separate webhooks may be used for different data types (e.g., logs/files vs. screenshots). The malware targets browser-stored data (including Chromium-based browsers such as Chrome, Edge, Brave, and Opera GX) and focuses on single-host surveillance rather than lateral movement.
Jun 29, 2026
Trellix disclosed technical details on **Skuld**, a Golang-based infostealer linked to an actor using the alias **Deathined**, after observing infections affecting systems globally. The malware targets **Discord**, **Chromium- and Gecko-based browsers**, and the local host, harvesting tokens, browser data, system and network information, screenshots, backup codes, and in some variants local files. Researchers said Skuld also injects JavaScript into Discord and can bypass protections from **BetterDiscord** and **Discord Token Protector**. The report said Skuld uses anti-analysis and anti-VM checks to hinder investigation and evade security tooling, while exfiltrating stolen data primarily through **Discord webhooks** and in some cases **Gofile**. Trellix assessed the malware remains under active development, noting that some capabilities, including a clipper and parts of its Discord injection logic, appear only partially implemented. The analysis also found strong code and behavioral overlap with open-source stealers and grabbers including **Creal Stealer**, **Luna Grabber**, and **BlackCap Grabber**, indicating the author likely ported existing functionality into Golang.
Aug 15, 2026