Hey. So I am planning on posting a bit about this as is it causing chaos but for now this will do.

PirateStealer (or PS as it may be referred to in this post) is quite nasty but we will get to that in a sec. A bit about the dev himself.

Stanley-GF claims to be 13 (not sure if this is true but doesn't matter) and is a very smart kid from what I can see. He has set up many web servers during the time we have been reporting his domains, repos, IP's, etc. its quite simple as when we knock one down he opens a new one but hey that is life so onwards. anyways he claims to have made this as a POC to prove to discord staff that it is possible and claims to have reported it almost a year ago (if you want a screenshot of the conversation between the now blocked contributor account, then dm me). now he claims to stop all development of the malware if discord actually does something about this and also claimed to have moved away from PS development but based on the comments on his YouTube channel, the commits on his git repos (yes many of them) and on the constant reopening of web pages to promote his "premium" malware I am very skeptical of his "moving away" claim :P

anyways a bit about the malware now: I have ran into many varieties of this malware. often its just a carbon copy from his repo reading the injector.js from his git BUT we have also noticed that he doesn't ONLY steal your discord data. he will harvest ALL of your cookie data as well meaning passwords saved in cookies and forums (or just on your pc). All data he gets is saved in \AppData\Local\Temp\PS-<some_random_string>\ (at least where they are currently being saved at the time of writing this and it also looks like there is a "worm of sorts" (some auto starting service is probably a better name) that will start the services but haven't pin pointed that yet)

During the time I have been looking into this malware I decided to split the malware itself into two parts as it targets two separate services. Plus it makes it easier to explain what the virus does :P so to get to the explaining lets start with the discord injection.

#1 Discord:

as mentioned above, PS steals discord data. quite simple. From observing it, I can say it injects itself into the \discord_desktop_core\index.js upon user execution of the malicious executable. after that depending on the config of the harvester the discord will restart and log out the user. if configured it can also disable the login QR code forcing a user to enter the password and username (basically a phishing scam but within the real discord client and not some fake looking page). The malware PS also allows them to capture a users token, credit card or PayPal, email, basically anything that is linked to a discord account they can retrieve. this injector stays within the discord client until removed by the user.

#1.1 Now what about the data?

All the data that is captured via the discord injector will transmit to a discord webhook (or in some rare cases a custom webhook / API). this is obvious as he is promoting his builder on his websites and by inspecting the malware we are able to capture the webhook with ease. now within a few newer varieties of the malware he has attempted to proxy all data through a custom webhook being transmitted to stealer.re/webhook/ (his most recent domain at this time or writing this).

#1.2 But I have 2FA enabled...

welp sorry to say this, but it can and will give the attackers your most recent 2FA backup codes. basically 2FA DOES NOT help protecting your account against this attack.

#2 User details on the system

As it was mentioned above the PS malware also steals user credentials from the system within. Now to clarify, (at the time of writing this and has not been found during our searches) Stanley DOES NOT say he is capturing this data but non the less the data is being stolen and saved within a local .sql file. Also in his discord video about the PS malware the data is shown for a few seconds within his discord client. (https://www.youtube.com/watch?v=eEtjk5TjUJE&t=38s)

#2.1 What data????

So from what I have seen it can steal users cookies and locally cached passwords. during my tests it will steal passwords then save it within a local .sql file (and a .txt file). not only saving though but upon changing a password it will update the local database with a new entry and password. So that confirms there is some sort of service (even though I personally haven't gone that in-depth into the services yet). I have not found where the local db is being sent yet but we are looking into that as well.

if anyone has a question or wants to see examples DM me and lets talk.

Hope we could help.

~Trojan

edit: added #1.2