hello world there's a new discord scam
you need to have on your radar this one
goes after your steam accounts now even
if you don't use steam or discord the
scammers method we're going to look at
could easily be repurposed so it's
really worth being aware of this one the
scam was initially reported on by
malwarebytes and starts when a victim
receives a message from what is probably
a bot with the promise of one month free
nitro all you have to do is link your
steam accounts to redeem the offer and
here is your first and main red flag i
would say overlook the dubiousness of
this link and you're probably screwed as
the next bit is really convincing what
appears to be discord nitro.com is
actually discord
niltro.com of course the domain this is
trying to emulate discord nitro.com
isn't even a real discord owned domain
and itself just redirects to some basic
parts domain advertisement nonsense also
i couldn't help but notice that
variations of this domain are also
registered a common theme with scammers
using lookalike domains is to replace
eyes with l's and vice versa i found
deliscord nitro.com was registered as
well as discord dash neutral and even
deliscord dash niltro was taken
anyway
the link takes you to a very well put
together phishing page the scammers have
done a great job of giving this the look
and feel of a genuine discord landing
page here's where things get interesting
tap that get nitro button and the steam
login window opens up prompting you to
log in through steam looks fairly legit
right just link your steam account and
you're good to go as it turns out this
new window isn't a chrome window at all
but rather just some fancy javascript
creating the illusion of a chrome window
within the web page if you try dragging
the window around it gets stuck in the
corner of the parent window giving away
that this isn't a chrome window in the
slightest to be fair this is incredibly
convincing the url in the fake window is
legit it even has the padlock indicating
that https is being used malwarebytes
posted some analysis of the traffic here
now if this was legit you would expect
to see some traffic going through steam
domains but instead login details are
sent to nitro dliscord.xyz
a similar setup was reported by redditer
two years ago so this technique isn't
brand new but it's definitely news to me
malwarebytes lists an array of domain
names known to be malicious and to be
fair this scam scores pretty high
unbelievability relatively speaking of
course firstly one month free nitro is
believable a tactic of smart scammers is
to offer you something that isn't
completely outside the realms of
possibilities a nigerian prince offering
you lifetime free nitro if you link your
steam account isn't quite as plausible
as just hey steam and discord have
teamed up to give you one month free now
i came across another steam scam
reported on by malwarebytes this one
whilst scoring pretty low on
plausibility is pretty hilarious
a gamergul messages you on steam telling
you how incredibly sorry she is that she
reported you to a steam admin for
scamming her by accident and that you
need to add the steam admin on discord
to explain the mistake the steam admin
comes across as a kind of archetypal
discord mod kind of a character he
doesn't take any bs doesn't like his
time being wasted and gives you no
opportunity to ask questions if you do
dare to question the legitimacy of the
steam admin you're sent this steam
support certificate of eligibility this
is meant to prove his authority
apparently look it's even it's even
signed by gabe newell himself though
oddly the signature doesn't look like it
spells out gabriel and in fact after
some light detective work it actually
maps to the signature of one avery
brundage former president of the
international olympic committee who died
in 1975 bit random but he's definitely
not gaining all the aim here is to grab
your steam verification and steam guard
codes stealing your account
something tells me this scam is headed
by a 14 year old with way too much time
on his hands rather than an
international cybercrime syndicate
now discord has become a bit of a hub
for all things malicious in the last
couple of years i'll link my other video
below on how discord is both being used
to host malicious files and is being
used by some bad actors to act as
commander control servers utilizing
discords to command waves of infected
computers
this video is sponsored by roboform the
easiest thing you can do to level up
your security is use a password manager
roboform keeps your passwords encrypted
until you need them and notifies you if
any of your passwords have been included
in a data breach helping you stay secure
robiform is one of the ogist password
managers they've been around since the
90s i also use them myself use the link
in the description to grab 30 off an
annual subscription bringing it to just
16
and there's a 30 day refund policy if
you aren't happy with roboform for any
reason
if you enjoy this kind of video make
sure to help me out by fondling the like
button for the youtube ai as well as
turning on those sub notifications if
you want to see what goes on behind the
scenes make sure to follow me on the
instagrams i'm at shanti i will of
course link it in the description and if
you're looking for something to watch
next go check out my previous video on
how a ransomware gang's mistake cost
them millions as always sources will be
linked in the video description stay
tuned for more hacking videos and have a
good one