Hackers are abusing Discord, Slack file

Links from Slack and Discord may not be as benign as they look.

Hackers are increasingly using Slack and Discord to distribute malware to unsuspecting victims, according to Cisco Talos research published Wednesday. 

Suspected cybercriminals have been uploading files to the platforms, which are then stored within the apps’ content delivery networks, resulting in a link to malicious content. Attackers then share the links outside of Slack and Discord — over email or on other chat applications, for instance — allowing hackers to share the link wherever they want.

It’s the kind of workaround that could allows hackers to meet targets where they already are — on platforms they trust and need to conduct business or socialize — which could allow them to boost the success of any social engineering efforts. 

Hackers have long abused people’s trust in chat applications to deliver malware to targets. Hackers previously used Discord to distribute Thanatos ransomware, according to Talos. In recent months, a hacking group that targets victims in the Middle East was caught trying to spread malware to targets by impersonating Telegram and other Android messaging applications, according to ESET research.

In this case, hackers are using legitimate infrastructure that otherwise seems trustworthy, Talos researchers noted.

“By leveraging these chat applications that are likely allowed, they are removing several of those hurdles and greatly increase the likelihood that the attachment reaches the end user,” researchers wrote. “The versatility of having a malicious URL that is hosted on a domain unlikely to get blocked is obviously attractive to malicious actors.”

Earlier this year Slack instituted protections to try to prevent this kind of trickery from duping users and non-users, a company spokesperson said.

“Keeping our customers and their data secure is our top priority at Slack,” the spokesperson said, adding that more protections are in the works. “To further prevent phishing scams and spam, we’re building industry-standard malware protection and link scanning, where malicious activity is automatically prevented. These tools will roll out this Spring.”

A Discord spokesperson said the company is working to proactively identify these kinds of issues.

“Platform security is a priority for us. Discord relies on a mix of proactive scanning – such as antivirus scanning – and reactive reports to detect malware and viruses on our service,” the spokesperson said.

Many emails exploiting this approach in recent months have typically been financially-themed, and aim to trick victims by claiming to contain links to documents that are invoices, purchase orders or fax documents, according to Talos. In fact, the documents usually contain malware.

In some cases, attackers have used the bad links to run multi-stage infections, in which the first piece of malware delivered to targets is used to deliver additional payloads, allowing for multiple phases of an attack to take place. Hackers have, for instance, used such a process to deliver Remcos, a remote access trojan that allows scammers to steal data from their victims, Talos researchers said.

In other cases, Talos researchers have observed hackers using Discord to effectively establish command-and-control communications by using webhooks, which allow them to update specific Discord servers with messages and information. In this case, hackers have been using a webhook functionality, which is a means that apps use to communicate with other technologies, as part of their data exfiltration efforts, according to Talos.

Talos did not name any victims explicitly, but noted that emails containing links leveraging Discord were written in multiple languages, including English, Spanish, French, German and Portuguese.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure