A new variant of the AnarchyGrabber malware has been discovered by MalwareHunterTeam which modifies Discord client files in order to evade detection and steal user accounts every time someone logs into the popular chat service.
The malware is distributed on hacking forums and in YouTube videos to allow cybercriminals to steal user tokens for a logged-in Discord user once it is executed. These user tokens are then uploaded back to a Discord channel under the attacker’s control where they can be collected and used to log in as their victims.
The original version of AnarchyGrabber comes in the form of an executable that can easily be detected by security software and only has the ability to steal tokens while it is running.
However, a newer version of the malware has been altered to avoid detection and establish persistence on a user’s machine.
Unfortunately, even if the original malware executable is deleted, the client files will already be modified. Security software has a hard time detecting these client modifications which allows the code to remain on a user’s machine without them even knowing their accounts are being stolen.
Until Discord decides to add client integrity into its software, Discord accounts will continue to be at risk from AnarchyGrabber2 and other malware that modifies client files.