Discord Desktop Client - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/discord-desktop-client/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 03 Jul 2026 13:21:19 +0000Non-Discord Application Accessing Discord LevelDBhttps://feed.craftedsignal.io/briefs/2026-07-non-discord-app-access-leveldb/Fri, 03 Jul 2026 13:21:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-non-discord-app-access-leveldb/This brief details the detection of non-Discord applications accessing the Discord LevelDB database on Windows endpoints, a critical activity often indicative of credential theft or sensitive data exfiltration by infostealer malware, which can lead to unauthorized access to user profiles and messages.This brief addresses the detection of unauthorized access to the Discord LevelDB database by non-Discord applications on Windows endpoints. This activity is significant as it may indicate attempts to steal Discord credentials or access sensitive user data. If confirmed malicious, this could lead to unauthorized access to user profiles, messages, and other critical information, potentially compromising the security and privacy of the affected users. The detection leverages Windows Security Event logs, specifically event code 4663, to identify file access attempts to the LevelDB directory by processes other than Discord. This behavior is commonly associated with infostealer malware such as StealC, Snake Keylogger, PXA Stealer, BlankGrabber Stealer, and Phantom Stealer, which target popular applications like Discord to exfiltrate user credentials and other sensitive data stored locally. Such attacks can result in account takeover, financial fraud, and further system compromise.

Impact

If this attack succeeds, victims face unauthorized access to their Discord accounts, leading to potential account takeover, message interception, and identity theft. Attackers can leverage compromised accounts for phishing, spreading malware, or accessing linked services. The exfiltration of sensitive user data, including personal messages and potentially financial information if stored or transmitted via Discord, can have severe privacy implications and lead to significant financial and reputational damage. While specific victim counts are not available, infostealer campaigns consistently target popular platforms like Discord, indicating a broad potential user base across various sectors is at risk from this activity.

Recommendation

  • Enable "Audit Object Access" in Group Policy for both "Success" and "Failure" on file access to ensure Windows Security Event Code 4663 is logged, as required for the Sigma rule provided.
  • Deploy the Sigma rule "Detect Non-Discord App Accessing Discord LevelDB" to your SIEM and tune for your environment to identify suspicious access attempts.
]]>highadvisorycredential-theftmalwarewindowsendpointinfostealer