Tap on your profile picture in the bottom-right corner of the screen to bring up the User Settings tab. Launch the Discord application on your phone. Should any process match with those present in the blocklist, Skuld proceeds to terminate the matched process as opposed to terminating itself.īesides gathering system metadata, the malware possesses capabilities to harvest cookies and credentials stored in web browsers as well as files present in the Windows user profile folders, including Desktop, Documents, Downloads, Pictures, Music, Videos, and OneDrive.Īrtifacts analyzed by Trellix show that it's engineered to corrupt legitimate files associated with Better Discord and Discord Token Protector and inject JavaScript code into the Discord app to siphon backup codes, mirroring a technique similar to that of another Rust-based infostealer recently documented by Trend Micro. Lucky for Discord mobile users, the process of setting your default browser is natively included in the Discord mobile app for both Android and iOS. It further extracts the list of running processes and compares it against a predefined blocklist. The malware, upon execution, checks if it's running in a virtual environment in an attempt to thwart analysis. Also spotted by Trellix is a Telegram group named deathinews, indicating that these online avenues could be used to promote the offering in the future as a service for other threat actors.

Discord web browser on mobile