Diagnostic Matrix: Phishing Signs vs Infection Symptoms
| Attack Stage | Scammer Presentation | Underlying Technical Threat | Definite Action |
|---|---|---|---|
| Initial Discord DM | Friendly "indie developer" asking you to test their Unreal/Unity demo for 20-50 dollars | Social engineering grooming; payload hosted on Mega, MediaFire, or Discord CDN | Block sender; report Discord user ID; never download unknown binaries |
| Downloaded Archive | Password-protected .zip containing an .exe or .scr file exceeding 500 MB (bloated size) | Padding technique to bypass online antivirus scanners (e.g. VirusTotal 650MB limit) | Do not execute; upload suspicious hash to hybrid-analysis sandbox |
| Execution Moment | Black command prompt flashes for 0.5 seconds, then nothing happens or game crashes | Infostealer launched: Dumps Chrome/Discord tokens, Steam SSFN, and crypto wallets | Disconnect Ethernet/Wi-Fi immediately to sever C2 exfiltration |
| Post-Infection Signs | Discord account sends identical playtest spam to all server friends; Steam password changed | Automated bot army takeover; machine actively beaconing | Clean OS reinstallation or full offline AV boot scan from USB |
A massive wave of cyber attacks targets gamers and aspiring game creators via direct messages on Discord, X, and Steam. Scammers impersonate passionate indie studios offering money or free copies to "playtest our new multiplayer demo", distributing infostealers (such as RedLine, Vidar, or Lumma).
Phase 1: Dissecting the Scam Blueprint
- The Password-Protected Archive Trick: The scammer provides a password-protected zip file. Antivirus mail gateways cannot inspect the archive without the password, allowing the payload to slip onto your machine.
- Artificial Size Inflation: The executable is inflated with dummy null bytes (zeros) to make it 700 MB. Most automated virus analysis engines have file size ceilings (typically 100 MB to 500 MB) and will skip scanning the file.
- The Silent Exfiltration: When executed, the malware extracts browser SQLite databases, pulling stored passwords, auto-fill credentials, and active session authentication cookies within 15 seconds.
Phase 2: Emergency Response Protocol (If You Already Clicked the EXE)
If you ran an executable from an untrusted Discord contact:
Step 1: Sever Physical Network Access (Within 10 Seconds)
Unplug your Ethernet cable or disable Wi-Fi. Stopping the malware from completing its encrypted HTTPS POST request to its Command and Control (C2) server can save your accounts.
Step 2: Invalidate Master Session Tokens from a Secondary Device (Smartphone)
From your smartphone (using cellular data, NOT your home Wi-Fi):
- Discord: Change your Discord password and enable 2FA. This immediately invalidates your active session token.
- Email Accounts: Change the passwords on your primary Google / Microsoft / Proton accounts. In your security settings, click Sign out of all sessions.
- Steam: Change your Steam password and deauthorize all devices via Steam Guard.
- Financial and Banking: Lock credit cards and change banking passwords.
Step 3: Eliminating the Infection
Because infostealers embed persistence hooks into Windows Task Scheduler, Startup registry keys, and inject into legitimate processes (svchost.exe), standard antivirus cleaning is unreliable:
- Download a portable rescue scanner (such as Malwarebytes Chameleon or Kaspersky Virus Removal Tool) onto a clean USB drive.
- Boot Windows into Safe Mode with Networking disabled.
- Run a full rootkit scan.
- For high-value machines, the only 100% guarantee against persistent kernel-level backdoors is a Clean Windows Reinstallation via USB installation media.
Verification Checklist
- Verify your Discord audit log shows no automated spam messages sent to friends.
- Confirm all email providers show active sessions logged out except your phone.
- Verify browser passwords are reset with multi-factor authentication enabled.