{"id":5629,"date":"2025-07-25T10:03:35","date_gmt":"2025-07-25T10:03:35","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/07\/25\/new-malware-attack-leverages-youtube-channels-and-discord-to-harvest-credentials-from-computer\/"},"modified":"2025-07-25T10:03:35","modified_gmt":"2025-07-25T10:03:35","slug":"new-malware-attack-leverages-youtube-channels-and-discord-to-harvest-credentials-from-computer","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/07\/25\/new-malware-attack-leverages-youtube-channels-and-discord-to-harvest-credentials-from-computer\/","title":{"rendered":"New Malware Attack Leverages YouTube Channels and Discord to Harvest Credentials from Computer"},"content":{"rendered":"

New Malware Attack Leverages YouTube Channels and Discord to Harvest Credentials from Computer
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A newly uncovered campaign is exploiting gamers\u2019 enthusiasm for off-beat indie titles to plant credential-stealing malware on machines.<\/p>\n

Branded installers for nonexistent games such as \u201cBaruda Quest,\u201d \u201cWarstorm Fire,\u201d and \u201cDire Talon\u201d are pushed through slick YouTube trailers and Discord download links that imitate legitimate early-access promotions.<\/p>\n

\n
\"\"
Promotional video (Source \u2013 Acronis)<\/figcaption><\/figure>\n<\/div>\n

The lures contain Electron-based executables weighing 80 MB or more, a size that helps them evade casual inspection while bundling the Node.js runtime needed to execute the attack code.<\/p>\n

Once the victim clicks the Discord-hosted file, the installer launches a Nullsoft (NSIS) package that quietly extracts an app.asar<\/code> archive holding the stealer\u2019s JavaScript<\/a> payload.<\/p>\n

Acronis analysts noted<\/a> that the operators sometimes forgot to strip the readable source from this archive, giving defenders a rare, unobfuscated view of their tactics and code lineage, which traces back to the Fewer Stealer family.<\/p>\n

Inside, researchers identified three active variants\u2014Leet Stealer, its customised fork RMC Stealer, and an apparently independent strain dubbed Sniffer Stealer.<\/p>\n

If the malware runs successfully, it can siphon browser passwords, cookies, Discord tokens, crypto-wallet files, and session keys for platforms like Steam and Telegram; victims risk account takeovers, financial loss, and sextortion-style blackmail.<\/p>\n

\n
\"\"
Fake website \u2013 www[.]barudaquest[.]com (Source \u2013 Acronis)<\/figcaption><\/figure>\n<\/div>\n

This shows one spoofed download portal that even reroutes Android and macOS clicks to the legitimate social game<\/a> Club Cooee while serving Windows users a weaponised .exe<\/code>, illustrating how convincingly the operators blend real and fake assets to widen their reach.<\/p>\n

Infection Mechanism: Sandbox Detection and Silent Browsers<\/strong><\/h2>\n

Every sample first verifies that it is not executing inside a security sandbox<\/a>. Hard-coded blacklists flag Hyper-V, VirtualBox, and low-RAM hosts; matching any item triggers a faux \u201cgame error\u201d dialog and terminates the process, a ploy that lets the malware masquerade as a faulty beta build while frustrating automated analysis.<\/p>\n

The critical logic looks like this:-<\/p>\n

const blacklistedGPUs = [\n  'VMware SVGA 3D',\n  'VirtualBox Graphics Adapter'\n];\nexec('wmic path win32_VideoController get name', (err, out) => {\n  if (blacklistedGPUs.some(gpu => out. Includes(gpu))) {\n    showFakeError(); \/\/ abort on virtual hardware\n  } else {\n    launchStealer();\n  }\n});<\/code><\/pre>\n
Passing these checks, the malware spawns the victim\u2019s own Chrome-family browser in headless debug mode, pointing it at https:\/\/mail.google.com<\/code> while exposing a remote-debugging port.<\/p>\n
Through that port the script extracts fresh cookies and autofill data directly from live memory, sidestepping disk-level encryption and locked files.<\/p>\n
Collected artefacts are zipped and uploaded to gofile.io<\/code>; fallback hosts such as file.io<\/code>, catbox.moe<\/code>, and tmpfiles.org<\/code> ensure exfiltration even if one service is blocked.<\/p>\n
A separate thread forwards the resulting download URL to the attacker\u2019s command-and-control server together with harvested Discord<\/a> tokens, providing immediate, full-session access to victims\u2019 chat histories and social graphs.<\/p>\n
By fusing polished social-media marketing with technical tricks like VM-aware execution and browser-debug extraction, the campaign demonstrates how modern commodity stealers are maturing into multi-layered threats that can outsmart both users and automated defenses alike.<\/p>\n
Experience faster, more accurate phishing detection and enhanced protection for your business with real-time sandbox analysis->\u00a0Try ANY.RUN now<\/a><\/strong><\/p>\n
The post New Malware Attack Leverages YouTube Channels and Discord to Harvest Credentials from Computer<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
New Malware Attack Leverages YouTube Channels and Discord to Harvest Credentials from Computer A newly uncovered campaign is exploiting gamers\u2019 enthusiasm for off-beat indie titles to plant credential-stealing malware on machines. Branded installers for nonexistent games such as \u201cBaruda Quest,\u201d \u201cWarstorm Fire,\u201d and \u201cDire Talon\u201d are pushed through slick YouTube trailers and Discord download links […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-5629","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5629"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=5629"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5629\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=5629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=5629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=5629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}