Monday, 26 July 2021 16:51

Sophos warns of Discord-borne malware


The Discord chat system is being increasingly targeted by the malware fraternity, according to security vendor Sophos

Sophos researchers have analysed more than 1,800 malicious files on the Discord content distribution network (CDN) that have been detected by the security company's telemetry.

The number of URLs hosting malware on Discord's CDN increased by 140% year-on-year during the second quarter of 2021, according to Sophos.

Threats include information stealing malware, spyware, backdoors, and ransomware resurrected as 'mischiefware.'


"Discord provides a persistent, highly-available, global distribution network for malware operators, as well as a messaging system that these operators can adapt into command-and-control channels for their malware – in much the same way attackers have used Internet Relay Chat and Telegram," said Sophos senior threat researcher Sean Gallagher.

Discord's vast user base also provides an ideal environment for stealing personal information and credentials through social engineering.

"These scams are not harmless – we found one malware that can steal private images from the camera on an infected device, as well as ransomware from 2006 that the attackers have resurrected to use as 'mischiefware.' The mischiefware denies victims access to their data, but there's no ransom demand and no decryption key.

"Further, adversaries have caught on that companies increasingly use the Discord platform for internal or community chat in the same way they might use a channel like Slack. This provides attackers with a new and potentially lucrative target audience, especially when security teams can't always inspect the Transport Layer Security-encrypted traffic to and from Discord to see what's going on and raise the alarm if needed.

"Discord users, whoever they are and whatever they use the platform for, should remain vigilant to the threat of malicious content that's lurking within the service and not just leave it to the Discord platform to identify and remove suspicious files. In addition, IT security teams should never consider any traffic from an online cloud service as inherently 'safe' based on the trusted nature or legitimacy of the service itself. Adversaries could be hiding anywhere."

Malware distributed via Discord is often disguised as gaming-related tools and cheats, but may also purport to be cracked versions of popular commercial software such as Photoshop.

The most common type of malware aims to steal information from victims. That includes password hijacking, keystroke logging, and image capturing from the screen or camera.

Android malware distributed this way includes code designed to steal access to online bank accounts and cryptocurrency.

Sophos recommends that organisations using Discord for work purposes adopt multi-factor authentication, ensure all devices used for work purposes have up-to-date malware protection, and use security products such as Sophos Intercept X and Sophos Firewall that can respectively detecting the actions and behaviors of malware, and inspect TLS-encrypted traffic.

Sophos also advises consumers to install a security solution such as Sophos Home on the devices that they and their families use for online communications and gaming, and to avoid downloading and installing unlicensed software from any source.

More details about Sophos' Discord research can be found here.

Subscribe to ITWIRE UPDATE Newsletter here


The much awaited iTWire Shop is now open to our readers.

Visit the iTWire Shop, a leading destination for stylish accessories, gear & gadgets, lifestyle products and everyday portable office essentials, drones, zoom lenses for smartphones, software and online training.

PLUS Big Brands include: Apple, Lenovo, LG, Samsung, Sennheiser and many more.

Products available for any country.

We hope you enjoy and find value in the much anticipated iTWire Shop.



iTWire TV offers a unique value to the Tech Sector by providing a range of video interviews, news, views and reviews, and also provides the opportunity for vendors to promote your company and your marketing messages.

We work with you to develop the message and conduct the interview or product review in a safe and collaborative way. Unlike other Tech YouTube channels, we create a story around your message and post that on the homepage of ITWire, linking to your message.

In addition, your interview post message can be displayed in up to 7 different post displays on our the site to drive traffic and readers to your video content and downloads. This can be a significant Lead Generation opportunity for your business.

We also provide 3 videos in one recording/sitting if you require so that you have a series of videos to promote to your customers. Your sales team can add your emails to sales collateral and to the footer of their sales and marketing emails.

See the latest in Tech News, Views, Interviews, Reviews, Product Promos and Events. Plus funny videos from our readers and customers.


Stephen Withers

Stephen Withers is one of Australia¹s most experienced IT journalists, having begun his career in the days of 8-bit 'microcomputers'. He covers the gamut from gadgets to enterprise systems. In previous lives he has been an academic, a systems programmer, an IT support manager, and an online services manager. Stephen holds an honours degree in Management Sciences and a PhD in Industrial and Business Studies.

Share News tips for the iTWire Journalists? Your tip will be anonymous




Guest Opinion

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News