This ransomware will steal your Discord account and encrypt all your files for good measure

(Image credit: Pixabay)

A new ransomware family has been detected targeting the cryptocurrency community.

Cybersecurity researchers from Cyble recently discovered a strain they dubbed “AXLocker” which, aside from the usual encrypting of all files found on the endpoint, also ends up stealing Discord authentication tokens from the victims.

Discord is a communications platform that’s been around for quite some time, but has recently found new life in the cryptocurrency community. NFT projects, crypto tokens, and similar start-ups have chosen Discord as their communications platform of choice.

48-hour deadline

When a user logs into Discord, the platform installs a small token onto the computer, so that the user doesn’t need to authenticate every time they come back. Stealing this token would allow threat actors access to the victim’s account, even without knowing their passwords or other login details.

Other than that, AXLocker is nothing out of the ordinary. Once triggered, the malware targets specific file extensions and avoids some folders. It encrypts the files using the AES algorithm, but it doesn’t change their extensions - they remain with their normal filenames. It demands payment in cryptocurrency and gives users 48 hours to comply.

While the NFT and crypto community is used to cyberattacks and various criminals going after their digital belongings, stealing Discord tokens in the process makes this ransomware attack a lot more potent.

> Kids are earning pocket money selling malware on Discord

> New Discord malware targets NFT and crypto fans

> Here's our rundown of the best antivirus services around

After all, should an owner, or developer, of such a project, have their Discord tokens taken, crooks could abuse their identity to launch fake campaigns and steal the community members’ NFTs and cryptocurrencies.

Still, according to BleepingComputer, the targets of AXLocker are first and foremost - consumers.

There was no word on AXLocker’s distribution method. Usually, threat actors would go for phishing emails, fake landing pages, and social engineering (fake LinkedIn identities, for example) to trick people into downloading and running the malware.

Check out the best firewalls right now

Via: BleepingComputer

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.