How Discord and Steam Are Used for Malware, Credential Theft, and Financial Crime
Summary
The article explains how criminals and state-linked actors abuse Discord and Steam for phishing, malware delivery, stolen credentials, command-and-control, and money laundering, and how compromised gaming devices can expose enterprise access.
Key points
- Malicious mods, cheats, and cracked games can deliver infostealers that harvest browser passwords, platform session tokens, and crypto wallet keys.
- Criminals use Discord communities to trade stolen credentials and tools, and host malware on its CDN to take advantage of trusted infrastructure.
- The article describes Discord-based command-and-control and data exfiltration by malware and state-linked actors.
- A claimed dataset of 89 million Steam accounts was investigated by Valve, which found it mostly contained expired SMS authentication codes rather than passwords or payment data.
- Steam accounts are also compromised through password reuse, phishing, and infostealers that capture active session tokens.
- Stolen payment cards have been used to buy tradable gaming items or currency for resale and laundering.
- An infostealer infection on a personal gaming computer can expose credentials and sessions that provide a route into an employee's enterprise access.
Article Details
- Topic
- Cybercrime and malicious activity exploiting Discord and Steam, including malware distribution, command-and-control, credential theft, and money laundering.
Threat Actors
Malware
AsyncRATPayloads included AsyncRAT, Skuld Stealer, and ChromeKatz — all designed to drain credentials, browser cookies, and active Discord session tokens.BeeNew stealers like Katz and Bee (the latter priced at just $300/month on criminal forums) were built with explicit focus on Discord and gaming platforms.ChaosBotIn late 2025, the Rust-based ChaosBot malware was discovered inside a financial services firm’s network, using Discord to create a private text channel named after the victim’s computer and receive commands through it.ChromeKatzPayloads included AsyncRAT, Skuld Stealer, and ChromeKatz — all designed to drain credentials, browser cookies, and active Discord session tokens.EchoCreepSeparately, the China-aligned APT group Webworm deployed a backdoor called EchoCreep specifically engineered to use Discord for C2, targeting government institutions and enterprises across Europe and Asia.KatzNew stealers like Katz and Bee (the latter priced at just $300/month on criminal forums) were built with explicit focus on Discord and gaming platforms.Skuld StealerPayloads included AsyncRAT, Skuld Stealer, and ChromeKatz — all designed to drain credentials, browser cookies, and active Discord session tokens.
Vendors
Products
Counter-Strike: Global OffensiveThe most documented case: Counter-Strike: Global Offensive container keys.DiscordTwo platforms in particular sit at the center of this, Discord and Steam.FortniteFortnite’s V-Bucks saw the same pattern: stolen cards used to bulk-buy currency, then sold at a discount on dark web markets and grey-market platforms.SteamTwo platforms in particular sit at the center of this, Discord and Steam.
Countries
Industries
Financial ServicesIn late 2025, the Rust-based ChaosBot malware was discovered inside a financial services firm’s network, using Discord to create a private text channel named after the victim’s computer and receive commands through it.GamingGaming has a cybercrime problem that goes way beyond cheaters and griefers.GovernmentSeparately, the China-aligned APT group Webworm deployed a backdoor called EchoCreep specifically engineered to use Discord for C2, targeting government institutions and enterprises across Europe and Asia.