Loading story…
Trellix disclosed technical details on Skuld, a Golang-based infostealer linked to an actor using the alias Deathined, after observing infections affecting systems globally. The malware targets Discord, Chromium- and Gecko-based browsers, and the local host, harvesting tokens, browser data, system and network information, screenshots, backup codes, and in some variants local files. Researchers said Skuld also injects JavaScript into Discord and can bypass protections from BetterDiscord and Discord Token Protector.
The report said Skuld uses anti-analysis and anti-VM checks to hinder investigation and evade security tooling, while exfiltrating stolen data primarily through Discord webhooks and in some cases Gofile. Trellix assessed the malware remains under active development, noting that some capabilities, including a clipper and parts of its Discord injection logic, appear only partially implemented. The analysis also found strong code and behavioral overlap with open-source stealers and grabbers including Creal Stealer, Luna Grabber, and BlackCap Grabber, indicating the author likely ported existing functionality into Golang.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository under hackirby/skuld publicly distributed the Go-based Skuld infostealer as a purported proof-of-concept, including source code and build instructions. The repository exposed extensive theft, evasion, persistence, Discord, browser, and crypto-wallet targeting capabilities.
Trellix Advanced Research Center discovered a new Golang-based infostealer named Skuld in May 2023 and later analyzed its data theft, anti-analysis, and Discord-focused capabilities.
Trellix assessed with high confidence that the actor using the alias Deathined created multiple social media accounts in April and May 2023 to promote Skuld or future malware offerings.
Trellix reported that the Golang-based infostealer Skuld was observed compromising systems globally beginning in late April 2023.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 242 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
trellix.com
Open sourceacronis.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cyble Research Labs reported that an upgraded **Hazard Token Grabber** malware strain is being used at scale to steal user data, with a primary focus on **Discord** users. The Python-based information stealer, first observed in 2021, has been distributed freely on GitHub while a more advanced version has been marketed through Discord and a dedicated website. Researchers said they identified more than **2,000 related samples** in the wild, indicating broad circulation of the malware. The malware establishes persistence, disables Discord token protection, and exfiltrates stolen data through **Discord webhooks**. In addition to Discord tokens, it targets Chrome credentials and cookies, Roblox cookies, Windows product details, geolocation data, and information from more than 20 applications and browsers. Its feature set also includes anti-debugging and anti-virtual machine checks consistent with **MITRE ATT&CK `T1497.001`** system-check sandbox evasion techniques, helping it avoid analysis while harvesting victim data.
Aug 15, 2026
Threat researchers reported a new **Python-based Windows information-stealing malware** dubbed **SolyxImmortal** that emphasizes *stealth and long-term persistence* over destructive actions. The implant is described as a “monolithic” package (not modular), delivered as a legitimate-looking Python script (e.g., `Lethalcompany.py`), and runs quietly in the background to harvest sensitive data including credentials, documents, keystrokes, and screenshots. SolyxImmortal’s command-and-control and exfiltration model relies on **Discord webhooks**, abusing trusted HTTPS traffic to blend in and reduce network-based detection. Reporting attributes the analysis to **CYFIRMA**, noting that C2 parameters are hardcoded and that operators can receive real-time notifications (including via a hardcoded Discord user ID) for high-value events; separate webhooks may be used for different data types (e.g., logs/files vs. screenshots). The malware targets browser-stored data (including Chromium-based browsers such as Chrome, Edge, Brave, and Opera GX) and focuses on single-host surveillance rather than lateral movement.
Jun 29, 2026
Researchers analyzed a **Rust-based information stealer** targeting Windows systems that harvested data from **Chromium-based browsers**, **Discord**, **Steam**, and multiple **cryptocurrency wallets**. The malware used anti-debugging checks, staged stolen files in directories disguised as Microsoft security paths, and compressed the collected data into a ZIP archive before exfiltration. The sample uploaded the archive to **gofile.io** and then attempted to send a JSON summary of the victim and stolen data to an attacker-controlled **GitHub Codespaces** endpoint on port `8080`. Investigators found the webhook attempt failed with an HTTP `302` response, but the Gofile archive remained publicly accessible without authentication, and code similarities suggested the stealer was based on or inspired by a publicly available Rust stealer repository on GitHub.
Aug 14, 2026