DISCORD INVITE LINK HIJACKING DELIVERS ASYNCRAT AND SKULD STEALER TARGETING CRYPTO WALLETS

Summary from the TLDR InfoSec newsletter

Attackers are exploiting Discord's invite system by hijacking expired vanity links to redirect users from trusted sources to malicious servers distributing AsyncRAT and Skuld Stealer malware targeting cryptocurrency wallets. The attack, designed to harvest credentials from Exodus and Atomic wallets via injection techniques, employs ClickFix social engineering to trick users into running PowerShell commands that download multi-stage payloads, followed by Skuld Stealer. The campaign targets users in the US, Vietnam, France, Germany, and other countries using trusted cloud services like GitHub, Bitbucket, and Pastebin to blend malicious traffic with legitimate communications.