AsyncRAT and Skuld Target Crypto Users: How Discord Invites Are Draining Crypto Wallets

AsyncRAT and Skuld target crypto users in a sophisticated malware campaign exploiting Discord’s invitation system. Cybercriminals are hijacking expired or deleted invite links to redirect unsuspecting users to malicious servers. These attacks deploy AsyncRAT, a remote access trojan, and Skuld Stealer, a Golang-based malware designed to steal cryptocurrency wallet credentials. According to Check Point Research, over 1,300 downloads have been tracked globally, affecting users in the U.S., Vietnam, France, Germany, and beyond. This article explores how these attacks work, their impact on crypto users, and how to protect your digital assets.

Key Takeaways

• Malware Threat: AsyncRAT and Skuld Stealer exploit Discord’s invite system to target crypto wallets.

• Hijacked Links: Attackers reuse expired or deleted Discord invite links to redirect users to malicious servers.

• Stealthy Delivery: The campaign uses ClickFix phishing, multi-stage loaders, and time-based evasions to avoid detection.

• Global Impact: Over 1,300 downloads tracked across multiple countries, with a focus on cryptocurrency theft.

• Protection Tips: Verify invite links, use antivirus software, and secure crypto wallets to stay safe.

Understanding the Discord Invite Hijacking Threat

What Is Discord Invite Link Hijacking?

Discord’s invitation system allows users to join servers via unique links. These include temporary, permanent, and vanity (custom) links for premium servers. Attackers exploit a flaw where expired or deleted invite codes can be reused as vanity links. This lets cybercriminals redirect users from trusted sources to malicious servers. Once users join, they encounter fake verification bots or phishing sites that trigger malware downloads.

How AsyncRAT and Skuld Stealer Work

AsyncRAT is an open-source remote access trojan (RAT) that grants attackers full control over infected systems. It uses a “dead drop resolver” technique, accessing command-and-control (C2) servers via Pastebin files. Skuld Stealer, written in Golang, targets sensitive data like Discord tokens, browser credentials, and crypto wallet seed phrases. It replaces legitimate wallet files with trojanized versions, exfiltrating data via Discord webhooks.

The Multi-Stage Infection Chain

The attack begins with a hijacked Discord invite link. Clicking it leads to a malicious server with a fake verification bot. Users are tricked into running commands that download a PowerShell script from Pastebin. This script retrieves a first-stage downloader from GitHub, which then fetches AsyncRAT and Skuld Stealer from Bitbucket. The process uses time-based evasions and sandbox checks to bypass antivirus software.

Why Crypto Users Are the Prime Target

The Rise of Crypto Wallet Theft

Cryptocurrency’s popularity makes it a lucrative target for cybercriminals. Skuld Stealer specifically targets wallets like Exodus and Atomic, injecting malicious JavaScript to steal seed phrases and passwords. Over 1,300 downloads have been recorded, with victims losing significant funds. The campaign’s focus on crypto wallets highlights its financial motivation.

Exploiting Trust in Discord

Discord is a trusted platform for gamers, crypto enthusiasts, and communities. Attackers leverage this trust by hijacking links shared on forums, social media, or official websites. Even legitimate links can become dangerous if they expire and are reclaimed by attackers. This social engineering tactic makes the campaign highly effective.

How the Malware Evades Detection

ClickFix Phishing Technique

The ClickFix phishing method tricks users into running malicious commands disguised as verification steps. These commands initiate the download of a PowerShell script, which blends into normal traffic by using trusted services like GitHub and Pastebin. This approach ensures the malware remains undetected by many antivirus programs.

Multi-Stage Loaders and Time-Based Evasions

The campaign uses multi-stage loaders to deliver payloads in phases, reducing the chance of detection. Time-based evasions, such as scheduled tasks and delayed execution, further help the malware bypass sandbox security checks. Attackers also update their downloader regularly to maintain a zero-detection rate on VirusTotal.

Bypassing Chrome’s App Bound Encryption

Skuld Stealer uses tools like ChromeKatz to steal browser cookies from Chromium-based browsers (Chrome, Edge, Brave). This bypasses Chrome’s App Bound Encryption (ABE), allowing attackers to access sensitive data even on updated systems. The use of legitimate cloud services for payload delivery adds another layer of stealth.

The Global Impact of the Campaign

Affected Regions

The campaign has a global reach, with over 1,300 downloads tracked across the U.S., Vietnam, France, Germany, the UK, and other countries. Crypto users are particularly vulnerable due to the targeted nature of Skuld Stealer. The widespread use of Discord amplifies the campaign’s impact.

Financial Motivation

The focus on crypto wallets indicates a clear financial motive. Stolen seed phrases and passwords allow attackers to drain wallets, with some victims reporting significant losses. The campaign’s sophistication suggests it may evolve, targeting other user groups like gamers with trojanized tools.

How to Protect Yourself from AsyncRAT and Skuld

Verify Discord Invite Links

Always check the source of Discord invite links before clicking. Avoid links from untrusted forums or social media posts. If a link seems suspicious, verify it with the server’s official website or community moderators. Regular link updates by server owners can prevent hijacking.

Use Robust Antivirus Software

Install reputable antivirus software and keep it updated. Regular scans can detect and remove malware like AsyncRAT and Skuld Stealer. Ensure your security software includes real-time protection to catch threats before they execute.

Secure Your Crypto Wallets

Store crypto wallet seed phrases offline in a secure location. Use hardware wallets for added protection. Avoid copying wallet addresses to your clipboard, as Skuld’s clipper module can swap them with the attacker’s address. Regularly monitor your wallet for unauthorized transactions.

Enable Two-Factor Authentication (2FA)

Enable 2FA on Discord and other platforms to add an extra layer of security. Skuld Stealer targets Discord backup codes, so avoid storing them digitally. Use authenticator apps instead of SMS-based 2FA for better protection.

Stay Informed About Cyber Threats

Follow cybersecurity news to stay updated on emerging threats. Resources like Check Point Research and The Hacker News provide valuable insights. Awareness of tactics like Discord invite hijacking can help you avoid falling victim.

The Broader Implications for Cybersecurity

Discord’s Role in Malware Distribution

Discord’s popularity and ease of use make it a prime target for cybercriminals. Past campaigns, like the fake “Cthulhu World” play-to-earn scam, also used Discord to distribute AsyncRAT and other malware. This highlights the need for stronger platform security measures.

The Evolution of Malware Campaigns

The use of Golang in Skuld Stealer reflects a growing trend among cybercriminals. Golang’s cross-platform compatibility and resistance to reverse engineering make it appealing for malware development. Expect more sophisticated campaigns as attackers adapt to security advancements.

Summary

AsyncRAT and Skuld target crypto users through a stealthy malware campaign exploiting Discord’s invitation system. By hijacking expired or deleted invite links, attackers redirect users to malicious servers hosting fake verification bots. These trigger a multi-stage infection chain, delivering AsyncRAT for remote control and Skuld Stealer for stealing crypto wallet credentials. The campaign uses ClickFix phishing, time-based evasions, and trusted cloud services to evade detection. With over 1,300 downloads globally, crypto users face significant risks. Protect yourself by verifying invite links, using antivirus software, securing wallets, and enabling 2FA. Staying informed is key to avoiding such threats.

FAQs

1. What are AsyncRAT and Skuld Stealer?

AsyncRAT is a remote access trojan that gives attackers control over infected systems. Skuld Stealer, written in Golang, steals sensitive data like crypto wallet credentials and Discord tokens.

2. How do attackers hijack Discord invite links?

Attackers reuse expired or deleted invite codes as vanity links for malicious servers. This redirects users from trusted sources to phishing sites or fake verification bots.

3. Why are crypto users targeted?

Crypto users are targeted due to the high value of cryptocurrency. Skuld Stealer focuses on stealing wallet seed phrases and passwords, enabling attackers to drain funds.

4. What is the ClickFix phishing technique?

ClickFix tricks users into running malicious commands disguised as verification steps, initiating the download of a PowerShell script that delivers malware.

5. How can I protect my crypto wallet?

Store seed phrases offline, use hardware wallets, avoid copying addresses to the clipboard, and monitor transactions regularly.

6. Can antivirus software stop AsyncRAT and Skuld?

Reputable antivirus software with real-time protection can detect and remove these threats. Regular updates and scans are essential.

7. What role do trusted cloud services play in this campaign?

Attackers use GitHub, Bitbucket, and Pastebin to host and deliver malware, blending malicious activity into normal internet traffic to avoid detection.

8. How does Skuld Stealer bypass Chrome’s security?

Skuld uses tools like ChromeKatz to steal browser cookies, bypassing Chrome’s App Bound Encryption on updated Chromium-based browsers.

9. Are other platforms besides Discord at risk?

While this campaign targets Discord, similar tactics could exploit other platforms with link-sharing features. Always verify links from trusted sources.

10. How can I stay informed about such threats?

Follow cybersecurity blogs like Check Point Research, The Hacker News, or TechNadu for updates on emerging threats and protection tips.

STAY AHEAD OF THE CURVE WITH THE LATEST TECH INSIGHTS AND UPDATES! FOR MORE TECH-RELATED NEWS, VISIT TECHBEAMS.