Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
46 IOCs
From Trust to Threat: Hijacked Discord Invites Used for Multi Stage Malware Delivery
Threat Actors
Malware Families
Excerpt
https://research.checkpoint.com/2025/from-trust-to-threat-hijacked-discord-invites-used-for-multi-stage-malware-delivery/ From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery By alexeybu Published: 2025-06-12 · Archived: 2026-10-27 02:03:26 UTC Key Takeaways Check Point Research uncovered an active malware campaign exploiting expired and released Discord invite links. Attackers hijacked the links through vanity link registration, allowing them…
Read the original report →Diamond Model
Adversary(4)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →46 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 53b65b7c38e3d3fca465c547a8c1acc53c8723877c6884f8c3495ff8ccc94fbe | High | Score 67/100 | First seen |
| URL | https://codeberg.org/wfawwf/dwadwaa/raw/branch/main/installer.exe | High | Score 67/100 | First seen |
| Domain | exported_cookies.zip | High | Score 67/100 | First seen |
| Domain | sims4-unlocker.zip | High | Score 67/100 | First seen |
| URL | https://i.ibb.co/GJGXzGX/discord-avatar-512-FCWUJ.png | High | Score 67/100 | First seen |
| URL | https://captchaguard.me/oauth-pass?code=zyA11weHhTZxaY3Fs3EWBg6qfO7t6j | High | Score 68/100 | First seen |
| Domain | wallets.run | High | Score 67/100 | First seen |
| URL | https://discord.gg/yzqks3d | High | Score 67/100 | First seen |
| Domain | unlocker.zip | High | Score 67/100 | First seen |
| SHA256 | db1aa52842247fc3e726b339f7f4911491836b0931c322d1d2ab218ac5a4fb08 | High | Score 67/100 | First seen |
| Domain | microads.top | High | Score 68/100 | First seen |
| Domain | wscript.network | High | Score 67/100 | First seen |
| SHA256 | f08676eeb489087bc0e47bd08a3f7c4b57ef5941698bc09d30857c650763859c | High | Score 67/100 | First seen |
| Domain | discodes.run | High | Score 67/100 | First seen |
| URL | https://pastebin.com/raw/ | High | Score 67/100 | First seen |
| Domain | system.run | High | Score 67/100 | First seen |
| SHA256 | 375fa2e3e936d05131ee71c5a72d1b703e58ec00ae103bbea552c031d3bfbdbe | High | Score 67/100 | First seen |
| SHA256 | d54fa589708546eca500fbeea44363443b86f2617c15c8f7603ff4fb05d494c1 | High | Score 67/100 | First seen |
| IP | 101.99.76.120 | High | Score 67/100 | First seen |
| Domain | objshell.run | High | Score 67/100 | First seen |
| URL | https://i.ibb.co/GJGXzGX/discord-avatar-512- | High | Score 67/100 | First seen |
| IP | 87.120.127.37 | High | Score 67/100 | First seen |
| URL | https://captchaguard.me | High | Score 68/100 | First seen |
| SHA256 | 160eda7ad14610d93f28b7dee20501028c1a9d4f5dc0437794ccfc2604807693 | High | Score 67/100 | First seen |
| SHA256 | 5d0509f68a9b7c415a726be75a078180e3f02e59866f193b0a99eee8e39c874f | High | Score 67/100 | First seen |
| URL | https://captchaguard.me/?key= | High | Score 68/100 | First seen |
| URL | https://pastebin.com/raw/NYpQCL7y | High | Score 67/100 | First seen |
| URL | https://discord.gg/T8CA7XrK | High | Score 67/100 | First seen |
| URL | https://pastebin.com/raw/ftknPNF7 | High | Score 67/100 | First seen |
| SHA256 | ef8c2f3c36fff5fccad806af47ded1fd53ad3e7ae22673e28e541460ff0db49c | High | Score 67/100 | First seen |
| URL | https://discord.gg/ | High | Score 67/100 | First seen |
| Domain | browsers.run | High | Score 67/100 | First seen |
| URL | https://pastebin.com/raw/QdseGsQL | High | Score 67/100 | First seen |
| SHA256 | 673090abada8ca47419a5dbc37c5443fe990973613981ce622f30e83683dc932 | High | Score 67/100 | First seen |
| URL | https://discord.gg/uzwgPxUZ | High | Score 67/100 | First seen |
| Domain | wshshell.run | High | Score 67/100 | First seen |
| Domain | tokens.run | High | Score 67/100 | First seen |
| SHA256 | 670be5b8c7fcd6e2920a4929fcaa380b1b0750bfa27336991a483c0c0221236a | High | Score 67/100 | First seen |
| Domain | commonfiles.run | High | Score 67/100 | First seen |
| URL | https://discord.gg/wAYq5GAsyH | High | Score 67/100 | First seen |
| URL | https://captchaguard.me/?key=aWQ9dXNlcm5hbWUyMzQ0JnRva2VuPTExMjIzMzQ0MDEyMz | High | Score 68/100 | First seen |
| Domain | wscript.shell | High | Score 88/100 | First seen |
| URL | https://pastebin.com/raw/zW0L2z2M | High | Score 67/100 | First seen |
| SHA256 | 8135f126764592be3df17200f49140bfb546ec1b2c34a153aa509465406cb46c | High | Score 67/100 | First seen |
| URL | discord.gg/y1zw2d5 | High | Score 67/100 | First seen |
| IP | 185.234.247.8 | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…