In another campaign using AsyncRAT, the malware downloader looked like a blank Microsoft document, but when opened used macros to deliver the bug. вЂњThe attackers achieved persistence through the creation of registry run entries to invoke the malware following system restarts.вЂќ вЂњAs is common with Remcos infections, the malware communicated with a command-and-control server (C2) and exfiltrated data via an attacker-controlled DNS server,вЂќ the report added. The data from the Discord CDN is converted into the final malicious payload and injected remotely, the report said. The team used this screenshot to illustrate this type of attack on Discord, showing a first-stage malware tasked with fetching an ASCII blob from a Discord CDN. вЂњThis technique was frequently used across malware distribution campaigns associated with RATs, stealers and other types of malware typically used to retrieve sensitive information from infected systems,вЂќ the Talos team explained. The researchers saw this behavior across malware, adding that one Discord CDN search turned up almost 20,000 results in VirusTotal. Messages were delivered by attackers in several languages, including English, Spanish, French, German and Portuguese, they added.Д¬DNs are also handy tools for cybercriminals to deliver additional bugs with multi-stage infection tactics. вЂњMany of the purport to be associated with various financial transactions and contain links to files claiming to be invoices, purchase orders and other documents of interest to potential victims.вЂќ вЂњIn most cases, the themselves are consistent with what we have grown accustomed to seeing from malspam in recent years,вЂќ Talos said. ZIP, and several less common types, like. Over the past year, they observed many common compression algorithms being used, including. This also means attackers can deliver their malicious payload to the CDN over encrypted HTTPS, and that the files will be compressed, further disguising the content, according to Talos. Once it has evaded detection by security, itвЂ™s just a matter of getting the employee to think itвЂ™s a genuine business communication, a task made easier within the confines of a collaboration app channel. The trick, the team said, is to get users to click on a malicious link. вЂњFiles can be uploaded to Slack, and users can create external links that allow the files to be accessed, regardless of whether the recipient even has Slack installed.вЂќ

Other collaboration platforms like Slack have similar features,вЂќ Talos reported. вЂњThis functionality is not specific to Discord. As an example, Talos uses the Discord CDN, which is accessible by a hardcoded CDN URL from anywhere, by anyone on the internet. The researchers explained that Slack, Discord and other collaboration app platforms use content delivery networks (CDNs) to store the files shared back and forth within channels. вЂњBy leveraging these chat applications that are likely allowed, they are removing several of those hurdles and greatly increase the likelihood that the attachment reaches the end user.вЂќ Content Delivery Network Abuse вЂњOne of the key challenges associated with malware delivery is making sure that the files, domains or systems donвЂ™t get taken down or blocked,вЂќ Talos researchers explained in their report. The pandemic-induced shift to remote work drove business processes onto these collaboration platforms in 2020, and predictably, 2021 has ushered in a new level cybercriminal expertise in attacking them.Д¬iscoвЂ™s Talos cybersecurity team said in a report on collaboration app abuse this week that during the past year threat actors have increasingly used apps like Discord and Slack to trick users into opening malicious attachments and deploy various RATs and stealers, including Agent Tesla, AsyncRAT, Formbook and others.

Workflow and collaboration tools like Slack and Discord have been infiltrated by threat actors, who are abusing their legitimate functions to evade security and deliver info-stealers, remote-access trojans (RATs) and other malware.

Discord opens but is blank