#Token grabber discord github code

The number of samples related to Hazard stealer has increased significantly in the last three months, as shown below. Figure 1 shows the statement made by the Threat Actor. This indicates that the malware present on GitHub might not be that evasive, and the TA has only uploaded it there for advertisement purposes. Interestingly few of the samples had either low or even zero detection.Īs per the statement made by the Threat Actor (TA), it appears that an upgraded version of Hazard Stealer can be accessed by purchasing it on their Discord server or website.

#Token grabber discord github code

Most of the samples seen in the wild are the actual Python source code of the malware used for compiling the binary, indicating that the malware has been used on a large scale. Both versions are available on GitHub for free.ĭuring our OSINT threat hunting exercise, we came across over 2000 Samples related to this stealer present in the wild. The initial version of Hazard Token Grabber was spotted in the wild in 2021, and we have observed an upgraded version now, which Threat Actors (TAs) are using to steal the user’s data.

GitHub notifies the appropriate service provider to respond accordingly-revoking the tokens and notifying the affected users-but we do not receive data on the number of validated tokens from partners.Upgraded version of Stealer Targeting Discord UsersĬyble Research Labs has come across a new strain of malware performing stealing activities named Hazard Token Grabber. * “Tokens for validation” represents the number of tokens we’ve sent to our token scanning partners for potential matches and thus may include false positives. Learn more about becoming a GitHub token scanning partner

It’s as simple as a bit of paperwork, defining some regular expression to match your token format(s), and setting up an API endpoint. If you’re a cloud or API service provider using tokens for authentication and authorization and would like to protect your users from these rare, but potentially devastating scenarios, we’d love to work with you. Service providers-help us prevent security breaches before they happen Here’s an example of how one user was notified about a Discord token that was accidentally submitted to a public repository : When we detect a match, we’ll notify the appropriate service provider and they’ll respond accordingly-revoking the tokens and notifying the affected users. Within seconds of those commits being pushed (or private repositories being made public), we scan the contents for a number of known token formats. On a typical day, we see almost nine million commits pushed to GitHub.

Now if you accidentally check in a token for products like Jira or Discord, the provider gets notified about a potential match within seconds of check-in, allowing them to revoke the token before it’s used maliciously. They’re in good company, joining other service providers including Alibaba Cloud, AWS, Azure, Google Cloud, Mailgun, npm, Slack, Stripe, and Twilio in protecting developers.

Since adding token scanning, we’ve sent our integration partners one billion tokens for validation.* Five new token scanning partnersĪs part of GitHub’s commitment to protecting our customers from security threats, we’re happy to announce that we’ve partnered with Atlassian, Dropbox, Discord, Proctorio, and Pulumi to scan for their token formats. About a year ago, we introduced token scanning to help scan pushed commits and prevent fraudulent use of any credentials that are shared accidentally. If you’ve ever accidentally shared a token or credentials in a GitHub repository, or read about someone who has, you know how damaging it can be if a malicious user found and exploited it.