it sucks, we're still trying to contact discord and get it fixed. but i wanted to take a second to point out how it happened, because the method they used was a lot more advanced than what i've seen before.
you might be familiar with an older scam that was rampant on the platform a few years ago -- you'd see a message from a friend claiming they were trying their hand at programming, perhaps, and that they'd made a "cool game" they want you to try out. (or really any sort of cover story.) bottom line is, they'd have a zip file for you to download, and upon running the exe inside it'd hijack your session credentials and send it over to the scammers, who could then log in, change your password, reset your 2fa, and you're SOL.
of course, discord's taken measures to limit this since then -- uploading seemingly any zip file with an exe inside gets the whole message completely eradicated (and replaced with a link to a random recipe? there's probably an in-joke i'm missing.) so they can't use that cover story anymore! they got craftier.
the new hotness
sancticide (that link's safe, it leads to a steam store page -- but if your gut didn't catch that, it's good to re-evaluate why!) might be a real game. i'm not sure, but it does look like there's been some legitimate articles covering it published in the past few days. however, the only noteworthy thing about this game as far as i can tell is that it doesn't seem to have an actual website. there's the steam page, a bunch of articles talking about its announcement, and then other unrelated junk.
it's perfect real estate for a target!
so the new grift, it seems, is to launch a website that looks like the right thing. add some screenshots from the steam page, copy the description, and add a download for a malicious payload, masqueraded as a demo. just on its own, that's pretty vile! but to take it a step further, they then take what good accounts they have -- previous victims -- and send their friends the site, with a plea to download it. (in this case, i received a message asking me to sign up for an account using a referral code, so "my girlfriend" could get past a mission. i don't want to think about the implications of a game with a mission like that.)
in both cases, the scammer is feeding off the good will of others to help them out. friends help friends, and they're your friend, right? it's awful and predatory, but stepping back from that it's honestly quite an impressive system. they'll go back and read previous DMs to get a sense of how the victim talks, use frequent emoji, do whatever to prove they're your friend, download the game, it'll only take a few minutes. it sucks.
what's their end goal, anyways?
money. they're in the business of misery. more specifically, in our case the scammer continued to use the account to send out more fraudulent links, and then when i called their bullshit out, tried to arrange a deal with my girlfriend (and then later with me), asking for an outrageous sum of money in return for not nuking her account. (they then, of course, lowered their asking sum further and further, in an attempt to get any amount out of us at all.)
so what do i do about this?
- if you've been hacked: as quickly as you can, attempt to change or reset your password and, if successful, kick off any and all other sessions. (you can look up a guide to do this, but in short: go to the settings, click "devices", and click the X next to each device that isn't the current one. you'll have to log back in on your other devices afterwards, but better safe than sorry). if you can't reset your password there's not much you can do other than contact discord support, as far as i know. good luck. you'll want to call your bank and tell them about it if you have your credit card hooked up -- they could run up a fortune buying nitro. also consider changing your passwords on any linked social media, especially if it's the same as your discord password.
- if your friend has definitely been hacked: don't engage with the scammer! they are not at all obliged to keep any promises they make, and if they know you'll pay they'll squeeze every last dollar they can out of you. instead, contact your friends: let them know your friend's been hacked, tell them not to click any links, kick them from servers if you can. give them as few entry points into future victims as possible.
- if you receive a link from a friend that you don't 100% trust: don't click that shit!! scan links, every time. make sure you're going to steampowered.com and not stearnpowered.com, etc etc. be vigilant, even if it's someone you've known for years.
- if you're reading this and you aren't convinced you'd fall for this: beware! i almost fell for this one, and i'm one of the most paranoid computer users in my friend groups! these scams only ever get craftier and more convincing. use your head, trust your gut, don't click links.
above all else, follow common advice. use secure, unique passwords on every site. use a password manager. use 2fa. 3fa, if it's available. don't click strange links. away from computer safety, have two points of contact for your loved ones. signal, twitter dms, facebook messenger if you're old, whatever you use. i wouldn't have been able to talk to my gf again if i didn't have her phone number (she's too far away).
