In October 2020 alone, we identified more than 5,700 public Discord attachment URLs hosting malicious content, mostly in the form of Windows executable files and archives. This post will detail the technical analysis of TroubleGrabber and provide insights on the generator and its creator. We discovered TroubleGrabber in October 2020 when researching public Discord attachments for our previous blog post, Leaky Chats: Accidental Exposure and Malware in Discord Attachments. Based on the file names and delivery mechanisms, TroubleGrabber is actively being used to target gamers. This information is sent via webhook as a chat message to the attacker’s Discord server. This malware, which primarily arrives via drive-by download, steals the web browser tokens, Discord webhook tokens, web browser passwords, and system information.

TroubleGrabber is written by an individual named “Itroublve” and is currently used by multiple threat actors to target victims on Discord. While it bears some functional similarity to AnarchyGrabber, it is implemented differently and does not appear to be linked to the same group. “TroubleGrabber” is a new credential stealer that is being spread through Discord attachments and uses Discord messages to communicate stolen credentials back to the attacker.

Discord ip grabber