Loading story…
A proof-of-concept malware called NitroRansomware was published on GitHub and later observed being promoted as a fake tool for generating free Discord Nitro codes. Written in C#, the ransomware encrypts files in common user folders such as Documents, Desktop, and Pictures, appends the .givemenitro extension, changes the victim’s wallpaper, and displays a ransom note demanding a $9.99 Discord Nitro gift code within three hours instead of cryptocurrency. The malware validates submitted gift-code URLs through Discord’s API and forwards valid codes to an attacker-controlled Discord webhook before releasing a decryption key.
The malware also includes broader credential-theft and persistence features beyond file encryption. Reported capabilities include adding itself to startup, collecting host details such as username and system UUID, stealing Discord tokens from LevelDB files, attempting to harvest browser data from Chrome, Brave, and Yandex, grabbing IP information, and exfiltrating data through Discord webhooks. Researchers said the sample used an embedded static decryption key, meaning some victims could recover files without paying, but warned that affected users should immediately change their Discord password because account tokens may already be compromised.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported on NitroRansomware samples shared by MalwareHunterTeam, describing a strain distributed as a fake free Nitro generator that appends the .givemenitro extension, changes the wallpaper, and demands a $9.99 Discord Nitro gift code. The analysis also noted the malware validates gift codes via Discord's API, contains an embedded static decryption key, steals Discord tokens and browser data, and can execute commands and exfiltrate results through a Discord webhook.
A GitHub repository for NitroRansomware was published, describing a C# proof-of-concept ransomware that encrypts files and demands a Discord Nitro gift subscription for decryption. The repository also documented features including startup persistence, host data collection, token grabbing, IP grabbing, and Discord webhook logging.
An update to the BleepingComputer article added that NitroRansomware also steals information from browsers. The added detail expanded the known scope of data theft beyond Discord token theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro analyzed **YourCyanide**, a Windows `CMD`-based malware strain tied to the **GonnaCope/Kekware/Kekpop** family that blends ransomware behavior with worm-like propagation and information theft. The malware uses multilayer batch-script obfuscation and staged payload delivery via **Discord**, **Pastebin**, and a Microsoft document link, then establishes persistence through **registry Run keys** and copies placed in the **Startup** folder. It can disable Task Manager, stop security tools, enable **RDP**, open firewall ports, and spread through email and removable drives. The malware also exfiltrates tokens, browser passwords, host details, and **Minecraft-related credentials** through the **Telegram Bot API** while attempting to evade analysis by checking for usernames associated with sandboxes and researchers. Trend Micro said the ransomware routine was not fully implemented at the time of analysis; instead of robust encryption, YourCyanide renamed files in common user directories and dropped ransom notes demanding **$500 in Bitcoin**, indicating an evolving threat that mixes disruptive and espionage-style capabilities.
Aug 14, 2026
Researchers reported a malware campaign that used fake installers and plugins on **GitHub** and **SourceForge** to impersonate popular software including **ChatGPT**, **Claude**, **AutoTune**, **Kontakt**, and **Ableton Live**, ultimately delivering the Deno-based backdoor **DinDoor**. The operation was promoted through compromised YouTube channels that posted AI-generated videos linking to malicious repositories; those videos reportedly drew more than **50,000 views** before takedowns. Infection chains typically relied on malicious MSI installers or PowerShell-based loaders that installed **Scoop** and **WinGet**, then deployed the **Deno** runtime to fetch and execute staged JavaScript payloads from attacker-controlled infrastructure. Once installed, DinDoor established persistence, profiled infected systems, and fetched additional malware including a Deno-based RAT capable of **remote execution**, **data theft**, **screenshot capture**, **SOCKS5 proxying**, and browser credential theft. Researchers said the malware also targeted **Telegram**, **Discord**, **Lightcord**, more than **50 crypto wallet extensions**, and at least **10 crypto wallet applications**. A standout capability used **Microsoft Edge**, the **Chrome DevTools Protocol**, and **WebRTC** to stream victim screens peer-to-peer while blending malicious traffic with legitimate browser activity. GitHub removed the identified repositories, but researchers warned the operators are likely to keep recreating malicious accounts and projects on trusted platforms.
Jun 29, 2026
Researchers detailed **Cyrat**, a Python-based ransomware strain that masqueraded as a DLL repair tool and primarily targeted English-speaking users while remaining capable of wider global spread. After execution, the malware encrypted files in common user directories, appended the `.CYRAT` extension, and dropped `RANSOME_NOTE.txt` ransom notes demanding **$1,000 in Bitcoin**, with a reduced **$500** payment offer if victims paid within two days. Technical analysis found that Cyrat used **Fernet** symmetric encryption via **PyCryptodome** to encrypt entire files, then protected the Fernet key with an **RSA public key** downloaded from **MediaFire** rather than embedding it in the sample. The encrypted key was stored in `EMAIL_US.txt` for victims to send back to the attackers, and the malware also downloaded an image, saved it as `background_img.png`, and changed the desktop wallpaper to draw attention. Researchers noted Cyrat had relatively low prevalence and contained coding flaws, including extension-matching issues and a reported `Pyfiglet`-related crash that could disrupt encryption.
Aug 15, 2026