Discord Exploit Unleashes AsyncRAT Stealer, Targets Cryptocurrency Wallets

Discord Exploit Unleashes AsyncRAT Stealer, Targets Cryptocurrency Wallets

Summary

• Discord invite links hijacked to send users to malicious servers.
• AsyncRAT and an info-stealer deployed to take control of victims’ computers and steal data.
• Cryptocurrency wallets are a key target.
• Discord users urged to be careful with invite links and “verification” steps.
• Researchers flag the trick as an easy way to abuse user trust.

Discord: A New Target in the Cyber Arena

Researchers at Check Point reported in June 2025 that attackers were hijacking Discord invite links to spread AsyncRAT, a remote access trojan, along with the Skuld Stealer info-stealer. AsyncRAT lets attackers control an infected computer remotely. Skuld targets crypto wallets and Discord accounts.

The Mechanics of the Attack

The trick starts with Discord invite links that have expired or been deleted. Attackers re-register the same custom invite code for their own server. Old links posted on websites and social media then lead to the attackers’ server instead of the real community. There, a fake verification bot tells users to run a command on their computer. That ClickFix step installs the malware. AsyncRAT can log keystrokes and take screenshots. The stealer goes after cryptocurrency wallets.

The technique works because people trust links they’ve used before. Nothing looks wrong until the fake verification step.

Why Cryptocurrency?

Cryptocurrency is a prime target because stolen funds can move quickly and are hard to recover. Once attackers have a wallet’s keys or recovery phrase, they can drain it in minutes.

For criminals, that speed is the appeal. A single infected wallet can pay off more than many stolen passwords.

A Collective Response Against Cyber Crime

The campaign shows why platforms, researchers and users all play a part. Discord has dealt with abuse of its invite system before. Any server that asks you to paste commands into your computer is hostile.

No real Discord server needs you to run a command in Windows to verify your account. That request alone is a red flag.

Protecting Yourself

Be careful with old invite links, especially from forums or old posts. Never run commands a Discord bot tells you to run. Turn on two-factor authentication. Keep large crypto balances in a hardware wallet.

This campaign is a reminder that attackers will turn a trusted platform’s normal features against its users.

The defense is mostly habit. Check where a link really leads. Refuse unexpected “verification” steps.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.