Researchers found an updated version of AnarchyGrabber that steals victims’ plaintext passwords for and infects victims’ friends on Discord.Detected as AnarchyGrabber3, the new trojan variant modified the Discord client’s %AppData%Discord[version]modulesdiscord_desktop_coreindex.js file upon successful installation. This process gave the malware the ability to load JavaScript files.The AnarchyGrabber version flexed this new capability when its victim first started up Discord. At this stage, the threat loaded “inject.js” from a new 4n4rchy folder. This file loaded another script called “discordmod.js” that together with inject.js logged the user out and prompted them to log back in.Once they logged back in, the new AnarchyGrabber variant attempted to disable two-factor authentication (2FA) on its victim’s account. It then got to work stealing its victim’s information including their user name, plaintext password and user token.The malware also looked to spread its reach to other Discord users. As explained by Bleeping Computer:When connected to the Discord, the modified client will also listen for commands sent by the attacker. One of these commands tells hacked Discord clients to send a message to all of the logged in account’s friends that contain malware they wish to spread.This spreader component makes it easier for the attacker to spread AnarchyGrabber3 to more targets or distribute other types of malware.
Commanding victim’s discord clients to spread malware (Source: Bleeping Computer)After modifying the Discord client, AnarchyGrabber did not run again. Such behavior made it difficult for antivirus software to detect the threat, as there were no malicious processes to spot. It also ensured that a victim ..
Support the originator by clicking the read the rest link below.
