Hackers Hijacked Discord Invite To Deliver AsyncRAT Malware

What happened

Hackers hijacked Discord invite to deliver AsyncRAT malware when threat actors began claiming expired Discord invite codes and injecting malicious links that lead users to servers hosting malware. Attackers monitored and reused Discord invite codes for previously boosted servers to redirect victims to fraudulent Discord communities. Once inside, links and payloads delivered AsyncRAT remote access trojans and customized stealer malware designed to extract cryptocurrency wallet credentials and other sensitive data. This multi‑stage campaign combined social engineering with abuse of Discord’s invite infrastructure to trick users across multiple countries into executing malware that grants remote system control and data theft capabilities. Dark Atlas researchers reported the activity, highlighting its reach and technical sophistication. 

Who is affected

Users of Discord communities spanning the United States, Vietnam, France, Germany, and the United Kingdom are impacted directly by malicious invite repurposing and malware delivery.

Why CISOs should care

This campaign demonstrates how threat actors leverage trusted communication platforms to distribute high‑impact malware, underscoring platform abuse risks, social engineering tactics, and the need for secure external link handling policies.

3 practical actions

• Harden invite management: Monitor and reclaim expired community invite codes; revoke unauthorized redirects.
• Increase malware detection: Expand endpoint monitoring for RAT indicators, payload dropper artifacts, and command‑and‑control connections.
• Educate users: Alert staff and stakeholders to avoid expired or unknown invites and inspect link destinations before interacting.