REDTIGER MALWARE STEALS DATA, DISCORD TOKENS, AND EVEN WEBCAM IMAGES

Summary from the TLDR InfoSec newsletter

RedTiger, an open-source Python-based infostealer repurposed by cybercriminals, targets Discord gamers (especially French-speaking users) to steal authentication tokens, payment information, browser credentials, cryptocurrency wallets, and webcam images while modifying Discord to maintain persistent access even after password changes. The malware evades detection by shutting down when it detects security tools, employs "mass file and process spamming" (creating 100 random files and launching 400 programs to hinder forensic analysis), and exfiltrates stolen data via GoFile with Discord webhook notifications to attackers. Security professionals should implement multi-factor authentication on Discord accounts, avoid downloading software from unverified sources, and recognize that legitimate security testing tools are increasingly weaponized for credential theft campaigns.