Sowing Discord: Reaping the benefits of collaboration app abuse
Summary: Cisco Talos reports that over 2020 threat actors increasingly abused collaboration platforms like Discord and Slack to deliver malware, hosting payloads on the platforms' CDNs so files could be fetched by URL without the app installed. Talos cites nearly 20,000 VirusTotal samples reaching out to the Discord CDN, with campaigns delivering RATs, stealers, Formbook, Nymaim, Remcos and AsyncRAT, and one WHO-themed COVID lure that chained Discord, Google Drive and a compromised site.
Bottom line: These platforms are likely allowed through your perimeter controls, so a malicious link hosted on a trusted CDN removes the blocking hurdles attackers normally face and raises the odds the attachment reaches the end user.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026