Informing you about censored games.

I fell for a discord hack, and how it works.[UPDATE: Got it back!]

Hello, now before before I get into everything I can say I contacted support literally minutes after it happened and have yet to hear back at time of this writing.

The current owner of my account is going by Vulsa#0001 and I humbly ask you all to report this profile(the Vulsa#0001 as shown in the image below [they changed it from 1337 to 0001] this paragraph) as hacked and dont worry, I have proof as a friend(bearded gamer is a IRL friend) snapshotted the change old profile https://i.imgur.com/YrTm8Yd.jpg
current profile https://i.imgur.com/udBdiJr.png

Now when you hear about people's discords getting "hacked" most never describe "how" probably because if its anything like me, its a bit embarrassing. But im going to lay it ALL out step by step of HOW I got hacked and use this as a write-up and informational post.

It starts when I get a message from a discord friend wanting to show me a game he made. This was mostly how I got bit because most of my discord friends are smart and have either made games, are good at coding or otherwise so while normally a red flag this wasnt for me. ( cue embarrassing thread https://i.imgur.com/MMvBNXl.png ).

I did was any friend would do and downloaded it (and while I noted it was a discord attachment, this is common if your handing it to a lot of people). I scanned it with microsoft defender (turns out its virus free! go figure) and I double clicked it [NOTE: this exe does NOT require UAC or elevated permissions to do its effect]. And since it didnt ask for admin privilege's I figured even if it was bad I would be fine, well that as a lie.


My friend TRAMS MI who also got bit earlier on that day (and subsequently bit me) is pretty smart with coding and looked at the exe. Its a poorly written mess with 1000's of lines of code complete with copyrights and names of the authors, the exe at least for me was called Valley_Jump. It uses node javascript commands and will or should show this on the exe hover.

How it works is pretty simple, discords program is based on chromium, and this attack makes use of exploits in unicode to do a few simple things.

1. It changes your email to a randomly generated email
   
2. It changes your password
   
3. Immediatly closes discord
   
4. gets a friend request from a bot which does a verification of some sort

This happens in about 3 seconds. I WAS able to sign back in but I felt something wasnt right so I went to my profile and my heart sunk as I saw a .xyz email https://i.imgur.com/kytBHcX.png . At this point I knew I was boned. I tried to no avail to change password and do everything in my power to reverse it but its far too fast to do anything as it locks you out.

As did I .

APPARENTLY none of that literally matters if you are currently signed in to a desktop discord as changing the email and password can be done IN SOFTWARE with no verification or 2FA needed. All that happens if you get an email saying it happened and if it wasnt you, change your password which was changed already in the 3 seconds before the app closes and logs you out after clicking the exe.



I fell into this because I trusted a friend, BUT I did the fatal mistake of not VERIFYING it. What I should have done is before clicking it was to get in VRChat or any other means that is not likely to also be hacked and verify that this was meant to be sent to me. I trusted a friend and I'm sorry.


Was it because your a furry?
No, this hack is furry agnostic apparently.

Was it because someone didn't like you?
No.

Okay was it because anything you said or posted?
Nope.

Well what was it?
Sit down for this one..... The reason why I was being targeted, and my friend TRAMS MI, and indeed ive been targeted before multiple times is because......

I had an early supporter badge.

You read that right, apparently for some ungodly reason accounts with this dumb badge fetch prices 300$-1000$ on a black market for reasons that baffle me. It means nothing, it gives you nothing its just a badge I got years ago for when I paid for nitro when it was early thats it and ive been harassed about it for years with people attempting to buy my account off me and me telling them no over and over.


Yes, this was my fault for trusting someone on my friends list and clicking a very spurious exe. I'll admit that till the end of my days. All I can say is that discord's security is swiss cheese if you are already logged in and simple non-escalated double click of an exe is enough to make it go poof with no asking of 2FA, yubikey, fido, phone varication or otherwise.

I feel that when you hear of discord hacks you never hear the why or how, probably because its embarrassingly easy for how it happened. But I'm putting it all out for you people to help you be prepared and to spot this and keep yourself safe. If I couldnt protect myself I can at least help others not fall for it, especially be concerned if its a close friend. Remember, you can trust something from a friend but be sure to verify it through another means like voice chat, facebook or call them up.

Thats it for me, I hope you all can spare a moment to report the account and maybe with some luck I can get it back. Dont worry about me, this isnt the first time I lost everything I'll be fine mentally, it sucks but ive gotten used to it you just got to keep on trucking and keep on keeping on.

After WEEKS of fighting with support and finally hearing back from them, I got the email transferred back to me but the 2FA on the account kept me locked out even though it was supposed to be using my old 2FA. Something messed up somewhere and it didnt work so i fought with support some more they were able to disable 2FA since I think it was new 2FA added after the fact which overwrote it.

Long story short i got it back!