Just as Xbox surprisingly lowered prices on its Game Pass Ultimate tier we have news of a new potential offering. This one comes via the Microsoft and Discord partnership that gives Discord Nitro subscribers access to a version of Game Pass dubbed Starter Edition.

The X profile Discord Previews discovered the new tier that seems to be separate from the Game Pass Ultimate deal that already exists. The Starter Edition appears to give you access to more than 50 games in the Game Pass library, plus 10 hours of Xbox Cloud streaming.

Additionally, you can earn Xbox rewards that can be put toward games, DLC, and gift cards.

It's not clear exactly what games make up the Starter Edition library. However, in the leaked art from Discord Previews you can see titles like Dishonored 2, Doom, Fallout 4, Gears 5, and Stardew Valley.

Earlier this week, new Xbox CEO Asha Sharma announced a new collaboration between Game Pass and Discord. She even teased that fans would "start to see some code in the wild" (per IGN).

"We're teaming up again as we continue to make Game Pass more flexible for our players. Some of you might start to see some code in the wild, and we will share more details with you all soon!" she wrote on X.

How it works

Currently, if you sign up for Game Pass Ultimate, you get a free month of Discord Nitro, which costs $10 a month. Nitro gives you perks like custom profiles, HD video streaming and different app themes in the chat service.

Per Discord Previews, the Starter Edition comes free for Nitro subscribers. It's not clear if Starter Edition will only be for Nitro subscribers or if anyone could sign up for that tier. We're also not sure if it'll be a new fourth Game Pass tier or replace one of the existing ones.

Beyond lowering the Ultimate tier price from $29.99/month to $22.99/month, this week Sharma released her vision for Xbox going forward.

Part of lowering the Game Pass price includes not putting new Call of Duty games on the service at launch. In her manifesto post, Sharma suggests "windowing" Xbox first-party games instead of putting them in Game Pass at launch. She mentioned that the company is reevaluating Xbox's approach to exclusivity, which suggests that Xbox exclusive games make a return.

The post says the goal is for Xbox to "fortify Game Pass with clear differentiation and sustainable economics."

A new Discord partnership appears to be the next step in that direction.

More from Tom's Guide

• The next Xbox console is Project Helix and it will 'play your Xbox and PC games,' new CEO promises
• Xbox isn’t dead yet — here’s how the gaming brand can make a comeback
• SCUF Gaming Promo Codes

The implementation of more detailed age verification on many of our favorite apps is become a path well trodden, but it's on the company to be as clear as possible about what that path means for the average user.

Yesterday, Discord announced on X that users would soon be required to verify their ages, or else be restricted to teen-level access on the service. The resulting debate has prompted the company to post a new statement that clarifies some key details.

The first thing to note is Discord is adamant that the majority of people will not be required to complete a face scan or upload an ID to use the app. In fact, the majority of users will never even see the prompt to confirm their age.

Instead, the only time that the app will require users to prove their age is when accessing age-restricted experiences, such as particular servers or modifying certain safety settings. The post indicated that, most of the time, users' ages will be ascertained via machine learning programs based on patterns of behavior and other factors. As such, many users will never have to supply extra confirmation via face scans and ID.

What were some of the concerns around Discord's plans?

While there is certainly an advantage to more stringent age verification (some countries, like the U.K., are even passing laws on it), many people are still wary about handing over so much private information.

In the case of Discord, this caution isn't without merit, as the company doesn’t exactly have the best track record in this area. Last year, we saw a massive data breach that affected thousands of Discord users. It seems Discord is aware of this concern, as the post states that facial scans remain on your device at all times and that IDs are only used to get your age, and then deleted.

The post also states that the company has partnered with “dedicated age assurance vendors who specialize in performing these verifications in a privacy-forward way. These vendors were not involved in the September 2025 data breach of our customer service agent.”

Discord is reportedly planning to roll out its new system in early March of this year, so we don't have long before we know precisely what these changes will mean for users.

Until then, let us know what you think in the comments below, including if you're looking for an alternative option to connect with like-minded communities.

More from Tom's Guide

• I discovered this iPhone Messages trick by accident and now I can't stop using it
• The Pixel 10a is about to 'break the record for laziest phone upgrade in history' — why the leaks are a red flag
• Galaxy Unpacked 2026 officially set for February 25 — how to reserve your Galaxy S26 Ultra now

VPN sign-ups are surging in Egypt amid a national ban of Discord. The move is an example of internet censorship and many are turning to the best VPNs in order to bypass the ban.

Beginning on January 9, 2026, Proton VPN has seen sign-ups increase to 320% over the baseline. We can assume other VPN providers, especially free VPNs, are also seeing an increase in sign-ups.

It's not clear who ordered the ban, but it appears to be blocked by several internet service providers (ISPs). At the time of writing, the ban is still in place and we don't know if it is temporary or permanent.

Internet censorship has already reared its ugly head multiple times in 2026. Egypt joins Pakistan, Iran, and Jammu and Kashmir in placing major internet restrictions on their citizens.

300% spike in VPN sign-ups

According to the Proton VPN Observatory, sign-ups to Proton VPN Free began to rise on January 9, 2026. As of January 12, 2026, sign-ups were 320% above the usual baseline.

David Peterson, Proton VPN General Manager, first reported a 103% increase in sign-ups on January 10, 2026. He reported that Discord was being blocked by two ISPs – Vodafone and WE (Telecom Egypt).

Peterson shared that Egypt has recently restricted "some social and VoIP platforms in an attempt to suppress emerging youth-led activism."

It isn't clear who ordered the ban and there has been no official government statement.

Users on Reddit have confirmed the Discord block. Vodafone and WE were both cited as not working. Orange users also reported trouble but Etisalat appeared to work for some users. However, all users who were using a VPN said they were able to access Discord – regardless of their ISP provider.

This shows the Discord block is not as extreme as in other countries – for example China or Russia. Using a VPN to connect to a server in a country where Discord isn't blocked should be enough for people to access the app.

Egypt and internet censorship

Egypt does have a history of internet censorship, but it is generally more moderate than other countries in the region and countries with more authoritarian governments.

According to the Surfshark Internet Shutdown Tracker, Egypt has restricted the internet once since 2015, at an average of 2.3 days, and ranks 28th in Africa for disruptions.

This current Discord ban could signal an increase of internet restrictions in Egypt. People in the country should consider using one of the best Egypt VPNs to keep their data safe and the internet open.

However you should always exercise caution when looking for ways to bypass internet restrictions as there may be associated risks.

Of the major VPN providers, Proton VPN leads the way when it comes to anti-censorship features. It boasts a free plan, the obfuscating Stealth protocol, Guest Mode, and the ability to disguise its VPN app.

NordVPN, ExpressVPN, Surfshark, Mullvad VPN, and more also offer obfuscation as standard or dedicated obfuscating protocols.

VPN obfuscation helps mask your VPN traffic, enabling you to effectively circumvent almost all forms of internet restrictions. One of the only times VPNs are rendered useless is when the internet is totally shut off – we are currently seeing this in Iran.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Discord has issued a warning to users after a third-party customer support provider, Zendesk, suffered a data breach on September 20th. As reported by the Malwarebytes Labs blog, attackers compromised the Zendesk systems which gave them access to Discord’s user data. They were then able to steal data including real names, Discord usernames, email addresses, IP addresses and details and messages with support agents.

Some billing information was also taken, including payment type, last four digits of credit card numbers and purchase histories. In the advisory notice, Discord explained that some users also had their government IDs taken as well — either their driver’s licenses or passports depending on what they used to appeal an age determination. Users who may have had this information exposed will be notified of this specifically in the email they receive.

A ransom demand was included so the breach seems to have been financially motivated. Discord disclosed the incident on October 3rd, and revoked the support providers access, as well as launching an internal investigation and notifying the affected users from a noreply@discord.com email address. There isn’t information about whether it paid the ransom, but the company does state in its press release that it has “reviewed our threat detection systems and security controls for third-party support providers” in order to ensure that third party systems meet the company’s security and privacy standards.

Rescana, a vendor risk management firm, claims that the attackers are Scattered Lapsu$ Hunters, which BleepingComputer also mentioned, but the group pointed to a different hacking group. Rescana has called the SLH group a coalition that combines tactics from other hacking groups that often steal data from third party providers of larger companies, and usually use social engineering tactics as methods (as opposed to malware infections).

How to stay safe after a data breach

As we've mentioned before, one of the main risks after a data breach is phishing attacks, which may look like they come from a legitimate retailer or website. So one of the things to stay on alert for is emails or texts that appear like they come from Discord. Likewise, you may see phishing emails which claim there is an order confirmation for something you didn’t buy.

We also recommend that you be on the look out for any emails that sound urgent and want you to “act now” to fix an issue, to provide additional personal or financial details, or need you to correct an account problem. It's also important to stay vigilant against social engineering attacks and to monitor your accounts for suspicious activity. The best way to stay safe against phishing is to avoid clicking on any links, QR codes or attachments in emails or messages from unknown senders.

If you haven't already invested in one of the best identity theft protection services, it's best to do so before it's too late. Those who have identity theft protection in place will be able to receive alerts for any suspicious behavior and will have experts on-hand should any of their data be misused.

From there, you'll want to make sure you're protected from online scams and hacks by using one of the best antivirus software solutions on all your devices, and when you're online, use their built-in protections like a VPN or a hardened browser to help keep you and your devices safe from malware and other online threats.

More from Tom's Guide

• These are the best Amazon Prime Day antivirus deals on packages for five devices (or more)
• Massive data leak just exposed the personal info of 6 million shoppers — how to stay safe
• Unity just patched a serious security flaw - update your games and apps now

Discord has confirmed one of its third-party customer service providers suffered a security incident. As a result, the personal information of certain users was accessed – including government-issued IDs.

We have seen age verification laws launched around the world, including in the UK, US, and the EU. Many have been attempting to use the best VPNs as a way of avoiding age checks, citing their perceived cybersecurity risks.

Experts have warned collecting sensitive personal information, such as government-issued IDs, is a "disaster waiting to happen" and sites adopting age verification would be a prime target for hackers.

Discord's case seems to reinforce this point, as IDs used for age verification were accessed. IDs were not directly submitted to the third-party in question but were reportedly shared by users "who had appealed an age determination."

Discord data accessed

Discord confirmed "an unauthorized party" targeted its third-party customer support services "to access user data, with a view to extort a financial ransom from Discord."

The type of data accessed depended on what users shared with customer support, but Discord data may include:

• Name, Discord name, email address, and other contact details
• Limited billing information
• IP address
• Messages with customer service agents
• Limited corporate data
• Government ID images

Discord said affected users will receive an email from noreply@discord.com and if an image of your ID was accessed, you will be informed of that in the email.

Full credit card information, CCV codes, passwords, and messages or activity on Discord was confirmed to be safe.

Upon learning of the incident, Discord revoked the third-party's access to its ticketing system and launched an internal investigation.

The relevant authorities and law enforcement were notified, and Discord reviewed its threat detection systems and security controls for third-party support providers.

Discord recommended "impacted users stay alert when receiving messages or other communication that may seem suspicious."

How does this connect to age verification?

The unauthorized accessing of sensitive personal information, including IDs used for age verification, highlights the security risks these laws pose – and why many want to avoid them.

The IDs were not stolen from a dedicated age check provider, and there haven't yet been reports of these services suffering an attack. But this incident reaffirms the dangers of sharing your personal information with potentially unknown third-parties.

Critics argue that people shouldn't need to submit personal information to access certain websites. The laws are in place to protect children from harmful content online, which is something that should be commended. However, there are more secure and privacy-focused ways of safeguarding minors.

Laura Tyrylyte, privacy advocate at NordVPN, said "device-level controls are the most effective way to manage children's internet access," Parental control tools were given as an example as you can limit app downloads, impose age ratings, and block material.

Age verification laws were introduced nationwide in the UK via the Online Safety Act back in July 2025. VPN usage spiked considerably in the country as people looked to bypass age verification checks.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Update 3/13/25: RestoreCord has reached out to us regarding this reported breach and the details of this article. Their team has explained that their services have not been compromised and the claims regarding their data security practices are unfounded.

Discord users should still maintain best practices when it comes to personal security, following the tips below to protect their accounts when using the service or any third-party services.

In February, a major security incident of RestoreCord services was disclosed on BreachForums, which said that nearly million user accounts including timestamps, last-serving IP addresses, usernames and Discord IDs were leaked.

As reported by LEAKD, the purpose of the breach is unknown and it's not yet clear if RestoreCord has been made aware of it or has taken any actions to secure its service. For those unaware, RestoreCord is a service that allows Discord users to back up their servers; it currently services 99 million members, has 100,000 customers and protects 55,000 servers.

A user by the handle of Sythe published data on a downloadable and reportedly clean .csv file that is freely available – although the file is hosted on a domain that is generally associated with malicious activity.

Though no passwords or direct messages appear to have been included in the compromised data, the combination of the exposed data that has been exposed – usernames, IDs, IP addresses – could still be used in malicious activities such as doxxing or targeted phishing attacks.

What to do now

Users affected by the breach should enable two-factor authentication and monitor their accounts for suspicious activity. There are concerns about the security practices of third-party services, and data protection and transparency in handling user information, so it's always best to stick to first-party ones when possible

In order to protect yourself and make sure you’re handling your own data safely, you should being using one of the best password managers, multi-factor authentication whenever possible and you should learn how to avoid any potential phishing attacks by recognizing common techniques.

Also, you can take steps to monitor your accounts by placing credit watches on yourself or having a good identity theft protection service in place. Some services will even remove your data from the internet for a fee if you wish to go that far.

Only time will tell as to why RestoreCord was targeted by hackers but even if your own Discord server data wasn't exposed, an incident like this may just be the wake up call you needed when it comes to sharing and protecting your data online.

More from Tom's Guide

• Billions of Chrome users at risk from new browser-hijacking Syncjacking attack
• FBI issues serious warning to iPhone and Android users — stop doing this ASAP
• Avoid these Super Bowl scams: how to stay safe during the big game

Emojis have become quite popular over the last few years as a means to quickly express ideas and emotions. However, hackers have now devised a clever new way to use them in their attacks.

As reported by Cybernews, a group of hackers have figured out how to modify the popular messaging service Discord to use it for command and control (C2). Hackers using Discord in their attacks is nothing new but a report from the cybersecurity firm Volexity highlights how this group is using the service alongside a number of common emojis.

Earlier this year, the Indian government came under attack from a Linux malware called Digomoji. Apparently the hackers behind it hail from Pakistan and have used emojis for C2 communication in several successful espionage campaigns.

To gain initial access, the researchers believe the hackers responsible used phishing attacks and malicious documents as a lure. Once installed on a vulnerable system though, the Digomoji malware creates a dedicated channel in a Discord server with each victim having their own separate channel.

From here, Disgomoji sends a check-in message back to the hackers with the target machine’s IP, username, hostname, OS and its current working directory. To make matters worse, the malware maintains persistence and remains on an infected system even after a reboot.

While we don’t have to worry about this particular malware strain yet, how the hackers behind this campaign use emojis to speed up their malicious activities is incredibly interesting and it could be a tactic we see other threat actors copy going forward. 

Hacking with emojis

Instead of writing out long strings of commands, hackers that have deployed Disgomoji onto a targeted system can use emoji to communicate with the malware instead. They send an emoji to the Discord channel for that particular target and the malware does the rest. However, Disgomoji uses the Clock emoji to let the hackers know a command has been processed and a Check Mark Button emoji is displayed when that command has been successfully carried out.

Here’s a table from Volexity with some of the other emoji used to communicate with the malware:

Discord also isn’t able to disrupt Disgomoji’s operations due to the fact that once a malicious server has been banned, the malware is able to restore itself by updating its credentials from a hacker-controlled C2 server.

The malware also has additional features to carry out its operations which include scanning a victim’s network, network tunneling and accessing a file sharing service for download and hosting the data it has stolen. Surprisingly, Disgomoji can also pretend to be a Firefox update and it can even ask victims to manually type in their passwords.

How to stay safe from hackers

Even though this particular malware strain likely won’t be used to target consumers anytime soon, you still need to be on the lookout for hackers if you don’t want to have your bank account drained or your identity stolen.

The easiest and simplest way to protect yourself from hackers is by running up to date software. This is because hackers love to target users running older software which still contains unpatched vulnerabilities. Though it may be annoying, taking the time to install that new OS or Chrome update could save you from falling victim to hackers.

From there, you want to make sure you’re using the best antivirus software on your Windows PC, the best Mac antivirus software on your Apple computer and one of the best Android antivirus apps on your smartphone. 

If you have an iPhone, both Intego Internet Security X9 and Intego Mac Premium Bundle X9 can scan your Apple smartphone for viruses but it needs to be plugged into your Mac via a USB cable. The same goes for your iPad. The reason you need to resort to using Mac antivirus software to scan your mobile devices is due to Apple’s own restrictions when it comes to malware scanning on both iOS and iPadOS.

At the same time, you want to be extra careful when checking your inbox or your messages to avoid phishing attacks. Look out for emails or messages from unknown senders, avoid downloading any attachments or files and don’t click on any links they contain. You also want to avoid letting your emotions get the best of you since hackers often try to instill a sense of urgency to get you to act quickly and not think things through.

Hackers are always coming up with clever new ways to repurpose popular tools, software and services and now it looks like they’ve managed to do the exact same thing with emoji.

More from Tom's Guide

• I’m a security editor and this is how I create strong passwords that are also easy to remember
• Millions of Discord users being tracked by spy site — what you need to know
• This thief stole hundreds of iPhones and drained users’ bank accounts — 3 essential tips for staying safe

Discord users need to be extra careful when using the popular chat service as a third-party company is currently scraping their messages and tracking millions of individual profiles.

As reported by The Register, the internet-scraping company Spy.pet has been actively harvesting data from Discord since November of last year. In the time since, it has collected over four billion messages and as of right now, Spy.pet is tracking 14,000 Discord servers and keeping tabs on more than 620 million users.

While data scraping is nothing new and happens on plenty of social media sites from Facebook to X (formerly Twitter) to LinkedIn, Spy.pet is being quite blatant about it. For instance, the Transparency section on its site leads to a page that only has the word “transparency” written on it, while clicking on the since removed “Request Removal” link just led to a video clip from 2004’s Spider-Man 2 in which J. Jonah Jameson laughs at Peter Parker.

Getting access to information about Discord users requires that you buy credits for $0.1 a pop using cryptocurrency first with a $5 minimum buy-in. Cached profile information costs 7 credits, while profile information with at least one server costs 10 credits. This means you can buy access to someone’s Discord profile for less than $1.

Besides stalking Discord users, Spy.pet also offers a special “enterprise” option, but you need to get in touch with the site’s owner to access it. The site’s creator highlights training AI models using Discord messages and gaining new intel sources for federal agents as some of the reasons why you might want to upgrade.

An investigation is already underway

Spy.pet might not be long for this world, though, as Discord is already looking into the data-scraping service. In a statement to The Register, a company spokesperson provided further insight into the matter, saying:

"Discord is committed to protecting the privacy and data of our users. We are currently investigating this matter. If we determine that violations of our Terms of Service and Community Guidelines have occurred, we will take appropriate steps to enforce our policies. We cannot provide further comments as this is an ongoing investigation."

Likewise, while writing this article, I noticed several changes to the site, including the removal of its “Request Removal” page. The site’s owner could be getting nervous, or Discord may have already gotten its lawyers involved. It’s hard to tell whether or not Spy.pet will be shut down at the moment, but given how blatantly it's abusing Discord’s data, the service’s days are likely numbered.

How to stay safe when chatting online

The discovery that Spy.pet is scraping Discord user data and selling it is the perfect reminder to be careful when posting online. 

While the best encrypted messaging apps can keep your chats safe from snooping, the same can’t be said for public services like Discord. This is why you should use a handle instead of your real name and avoid sharing personally identifiable information (PII). At the same time, if you want to avoid being tracked across different services, you may want to use a separate handle that isn’t the same as the one you use on Steam, Xbox or PlayStation.

If you use Discord frequently, you should also consider investing in one of the best antivirus software solutions since cybercriminals have used the platform in their attacks in the past. For those who are really concerned about their data and how it could be misused, you might want to look into the best identity theft protection services too.

We’ll likely hear more from Discord regarding Spy.pet once the company finishes its investigation into the matter. In the meantime, though, it’s worth reevaluating how you act and what you say online, even if you think you’re just in the company of friends.

More from Tom's Guide

• New Android banking trojan impersonates Chrome to steal your money
• Discord scam sees hackers offer easy cash for testing projects 
• This malware is taking over Discord accounts and stealing browser data

Discord is a fantastic chat app for gaming that allows groups of players to come together to chat while playing. It's grown so popular that people use it for all kinds of group chats outside of gaming. As popular as it is, though, it's been difficult for the company to make money. 

Discord offers a subscription-based model that unlocks extra features for dedicated users, but that doesn't seem to be enough to keep the company in the green. To counteract this and try to generate more income, The Wall Street Journal (through people familiar with plans) has discovered that Discord plans to introduce ads to its apps in the very near future, which is sure to upset some of its longtime users.

Discord was released in 2015 and has been ad-free all along, which could make this transition difficult for some. It promises to keep advertisements relevant to its gaming-centric users, so at least players who frequent the app shouldn't see ads for anything out of their comfort zone. 

Outside of traditional advertisements, Discord is set to offer rewards for players who stream specific games to their friends and complete certain in-game tasks, which could allow gaming companies to pay to have their software pushed through Discord, creating more engagement and a chance at some more viral marketing.

For its ad push, WSJ claims that Discord is in the process of hiring over a dozen people charged with implementing advertisements into the app and selling ads to gaming companies. Job listings like Engineering Manager—Revenue Growth are listed, which could relate to ad revenue generation.

Users will have the option to turn off personalized ads within the settings, but the company says ads will still appear within the app. Users will have the option to hide ads (or Quests, as Discord is calling them) that don't interest them, whether they're Discord Nitro subscribers or not. 

Obviously, a company needs to make money, but it'll be interesting to see whether Discord can keep its large user base while also introducing ads. If the company can implement them in a way that isn't too intrusive, it might not be a big issue. On the other hand, if the ads become a problem, it could hurt Discord's long-term prospects. Will Discord users flock back to apps like TeamSpeak for gaming communication? Only time will tell.

More from Tom's Guide

• Samsung Galaxy S25: All the rumors so far
• Where to buy solar eclipse glasses — here's where to find them ahead of April 8
• New on Netflix: 5 movies and shows to watch this week (April 1-7)

Hackers are now using the popular chat app Discord to find potential victims and infect their computers with a dangerous, info-stealing malware.

According to a new blog post from the cybersecurity firm Trend Micro, hackers are now abusing Discord’s content delivery network (CDN) to host and spread the Lumma Stealer malware. At the same time, they’re also using the chat app’s API to create bots capable of communicating and remotely controlling the malware.

First detected back in August of last year, Lumma Stealer is a malware written in the C programming language which steals usernames and passwords along with other sensitive data from an infected PC. It’s currently being rented out to other hackers by its creators as a Malware-as-a-Service offering for just $250 per month. However, with Lumma Stealer’s highest paid plan, hackers get access to the malware’s source code and can even modify it to better suit their attacks.

While Lumma Stealer was previously used to target YouTube users through spear-phishing emails, Trend Micro’s security researchers have observed a new campaign that uses this malware strain to go after Discord users.

Whether you use Discord when playing games with friends on one of the best gaming PCs or you have kids at home that often use this popular chat app with their friends, this new Lumma Stealer campaign isn’t something you want to ignore, as falling victim to it could let hackers take over all your online accounts after stealing those passwords. 

Targeting users via Discord

To avoid being detected, the hackers behind this campaign typically use random Discord accounts to send a direct message to potential victims. However, compromised Discord accounts are also used to do this, which means that a message from one of your friends could be from a hacker instead.

Regardless of which type of Discord account is used to contact you though, the message sent by the hackers behind this campaign remains the same. Basically, they reach out to potential victims seeking help with a project under the guise of getting you to test it. For your time, you’ll be paid $10 through PayPal or sent a Discord Nitro Boost which lets you buy special perks and features for specific servers.

As it only takes four to five minutes to test the project and leave a review according to the hackers, it’s likely that younger gamers might fall for this scam. Before the testing can begin, though, the hackers send over a malicious link which downloads an installation file that contains the Lumma Stealer malware.

Once executed, the malware tries to steal funds from crypto wallets as well as sensitive data like usernames and passwords stored in a victim’s browser. With your credentials in hand, the hackers behind this new Lumma Stealer campaign can take over your accounts, commit fraud or potentially even steal your identity.

How to stay safe from malware

Regarding this particular Lumma Stealer campaign, Trend Micro recommends that all Discord users should exercise caution when it comes to unexpected or unsolicited direct messages from unknown senders. 

Just like with your email, you should avoid opening any links or downloading any attachments from unknown senders that arrive in Discord’s message center. However, you'll also want to be careful when opening links that appear in a public Discord server, as they could take you to phishing sites or other dangerous websites.

To keep your PC protected from malware and other online threats, you’re going to want to use the best antivirus software. If you’re on a tight budget though, Windows Defender is a free antivirus from Microsoft that comes pre-installed on all Windows PCs.

As with Facebook and other popular online services, hackers will likely continue to abuse Discord and its features in their attacks. This is why you need to remain vigilant online and avoid clicking on suspicious links and downloading files from people you don’t know personally.

More from Tom's Guide

• FBI warns phantom hacker scams are emptying financial accounts
• ChatGPT now being used in dating apps to catfish users
• Facebook scam locking users out of their accounts — don’t fall for this

A new open-source Windows malware strain which can covertly steal passwords and other sensitive data is currently making the rounds online.

As reported by the cybersecurity firm Cyble in a blog post, this new info-stealing malware has been dubbed Exela and it uses the Discord client for Windows to send stolen data back to the hackers behind this campaign.

Besides stealing login credentials, personal data and even financial information, the malware is also capable of stealing session details from a wide range of popular apps and online services including social media and gaming platforms.

The Exela Stealer was first spotted on VirusTotal by security researchers at Cyble on September 14. However, the initial version of this malware was created and uploaded to GitHub back in May of this year. In the time since, new capabilities have been added to Exela and the malware also has its own official Telegram channel.

What sets Exela Stealer apart from other Windows malware though is how it uses Discord to exfiltrate stolen data from infected PCs.

Sending stolen data through Discord

Once downloaded on a computer, Exela’s builder will only run if a compatible version of Python (version 3.10.0 or 3.11.0) is installed on the machine. If this is the case, the builder then starts the process of creating an executable or .exe file.

When the malware’s builder batch file inside the Exela setup folder is executed, a Discord webhook URL is required to proceed. If a victim doesn’t provide this URL, an error message is displayed until they do.

The Exela Stealer uses this Discord webhook URL to act as a remote server for the hackers who have deployed the malware. Essentially, the webhook is used to send all of a victim’s stolen data back to the hackers.

After being fully installed on a victim’s PC, Exela Stealer achieves persistence by copying itself into a new directory in their local app data folder. It also adds a startup entry in Windows Registry so that the malware continues to run even after the infected PC is rebooted.

Exela Stealer then targets any Chromium-based web browsers like Chrome, Edge, Brave, Opera or Vivaldi that are installed on a victim’s computer. Besides credentials, the malware can also steal credit card information, cookies and other browser data while logging keypresses and taking screenshots of the system. Exela Stealer can steal loads of info from social media platforms including Instagram, X, TikTok and Reddit along with data from both Steam and Roblox.

All of this stolen data is then sent back to the hackers behind Exela Stealer who can use it to commit fraud or even identity theft.

How to stay safe from Windows malware

There are several steps you can take to stay safe from Windows malware but most importantly, you need to be extra careful when visiting certain websites and downloading new software.

You want to be on the lookout for major red flags like spelling and grammar mistakes that indicate that the site you’re visiting is actually a phishing page. Likewise, you only want to download new software for your PC from reputable sources like the Windows Store or directly from the company that makes it. Piracy not only hurts developers but you’re more likely to come down with a bad malware infection when you try to download games or software illegally.

These steps can help you avoid running into Windows malware in the first place but to keep your PC protected, you should also be using the best antivirus software on your computer. Microsoft Defender works well enough if you’re on a tight budget but it just can’t match the features and regular updates that you get with a paid antivirus.

At the moment, the Exela Stealer is being distributed through phishing pages and websites offering free software downloads. However, given the malware’s capabilities, cybercriminals could devise new distribution methods going forward, so it’s certainly worth keeping an eye on.

More from Tom's Guide

• This dangerous Android malware is stealing from 100 banking apps
• Intel-based Macs under attack from new MetaStealer malware
• Prime Big Deal Days: How to shop safely during Amazon’s next big sale

Windows PCs are under attack from a new Golang-based malware strain capable of stealing all sorts of sensitive data from vulnerable systems.

As reported by The Hacker News, this info-stealing malware has been dubbed Skuld by its developer, who goes by the alias Deathined. First discovered at the end of April by security researchers at Trellix, the malware is currently being used to target gamers and other Windows users in the U.S., Europe and Southeast Asia.

What sets Skuld apart from other malware strains is that it’s written in Golang (aka Go) which lets malware authors “produce binary executables that are more challenging to analyze and reverse engineer” according to Trellix’s report.

Skuld creator Deathined has also taken inspiration from a number of open-source projects and existing malware samples. It appears that the malware developer is in it for the long haul as they have created several social media accounts, including a group on Telegram that will likely be used to promote their malware business going forward.

What makes Skuld particularly dangerous is the sheer amount of data it’s able to steal and send back to hackers from a compromised Windows PC. This includes a user’s browser data like cookies and session tokens but Discord accounts are also at risk from being taken over by hackers.

Skuld info-stealing malware

Like many other recent malware attacks with gamers in their sights, Skuld is targeting Discord users, which suggests that Deathined may be more interested in going after the gaming industry than other businesses.

Once opened on a victim’s computer after being downloaded through a malicious link or attachment, Skuld first checks to make sure it isn’t running in a virtual environment. This is to avoid having the malware analyzed by security researchers like those at Trellix.

In addition to collecting metadata like the IP address and Windows license key from a user’s system, Skuld can also harvest any cookies or credentials stored in their browser. However, it can also steal files from a user’s profile folders like their Desktop, Documents, Downloads, Pictures, Music, Videos and OneDrive.

From here, Skuld then injects JavaScript code into the Discord app in order to steal a user’s backup codes and take over their account. There’s also a clipper module in some samples of the malware analyzed by Trellix that could be used to steal cryptocurrency wallet addresses and any other sensitive data stored on a victim’s clipboard.

Once all of this data has been collected, it’s then sent back to the hackers who deployed the malware to be used for fraud, other cyberattacks or even to commit identity theft.

How to stay safe from malware on Discord

Like any other social platform, Discord can be abused by hackers in their attacks since it allows users to chat with one another while sending links and even files. Both links and files shared on Discord could be malicious, so you need to be careful when using the service and this goes for your kids as well.

For starters, you want to avoid clicking on any suspicious links sent to you by new friends or other people on any Discord servers you’ve recently joined. Besides links that look strange at first glance, you also want to watch out for shortened links, as they could take you to phishing sites or fake sites hosting malware.

In order to secure your Discord account, you want to enable two-factor authentication while also using a strong password. Instead of coming up with a simple password on your own, you can use one of the best password managers to generate one for you. You also want to make sure that you have the best antivirus software running on your PC to limit the impact of a malware infection if you do accidentally download something suspicious from Discord.

Now that Skuld’s creator Deathined has registered several different accounts to promote their malware, expect to see similar attacks targeting gamers going forward.

More from Tom's Guide

• 6,000 sites are impersonating 100 top brands to steal your banking info
• Hackers hijacked 2K’s support site to spread malware to gamers
• Over 400 million infected with Android spyware delete these apps right now

Finally, you can now use Discord on PS5 thanks to the new PS5 system update. While PlayStation users have been able to link their PSN and Discord accounts for several months, proper integration has been a highly requested feature. This closer integration of the two platforms now allows you to participate in a voice chat via Sony’s flagship gaming console. 

While the PS5 console does offer its own party voice chat function, this can only be used to talk to people on the PlayStation platform. Whereas through Discord you can communicate with friends and teammates even if they’re playing on another platform such as PC or Xbox. This makes Discord especially handy if you’re playing one of the best cross platforms games. 

If you’re a regular Discord user, it’s also pretty convenient to be able to continue your conversations even when you’re playing on PS5. Plus, you don’t even need to purchase one of the best gaming headsets to start chatting on Discord, you can make use of the DualSense controller’s in-built microphone — although be warned it’s not the best quality mic. 

Right now, actually using Discord on PS5 is a slightly finicky process, and it also requires you to first link your two accounts together. But don’t worry if all the menus and submenus have you a little confused, we’re on hand to break down everything you need to know in order to use Discord on PS5. 

Please note, the walkthrough below will guide you through the process using Discord on mobile, but the steps are the same if you’re using Discord via desktop. However, tabs, submenus and buttons may be located in different places. With that bit of housekeeping out of the way, let’s dive into our guide on how to use Discord on PS5.

Discord on PS5: How to link your Discord and PSN account 

1. Open Discord, then your profile
2. Click Connections 
3. Press Add
4. Select PlayStation Network
5. Press Get Started
6. Log into your PSN account
7. Check your PSN account is linked

Read on to see detailed instructions for each step.

Discord on PS5: How to join a Discord voice chat on PS5 

1. Start or join a voice channel on Discord 
2. Swipe up from the bottom of the screen
3. Click Join on PlayStation 
4. Select your PS5 console
5. Press Join Call on PlayStation 

Read on to see detailed instructions for each step.

And that's all there is to it, you can now join a Discord voice chat on PS5. This feature is especially handy for chatting with friends and squad mates playing on a different console such as Xbox Series X. But you should be aware you cannot voice a Discord voice chat and a PSN party chat at the same time, so you may have to make a difficult choice if you've got multiple conversations on the go. 

Speaking of Xbox, we also have a guide dedicated to explaining how to use Discord on Xbox One (the process is the same on the Series X). And if you want to get even more out of your next-gen PlayStation be sure to check out our roundup of the best PS5 tips that everyone needs to know. Plus, we also have dedicated guides on how to upgrade PS5 internal storage and how to transfer data from PS4 to PS5. Also, did you know you can play PS5 games on the move, you just need to know how to use Remote Play on PS5. And were you aware of how to access the PS5 secret browser?

The latest PS5 system update is now rolling out globally as confirmed via the PlayStation Blog and this new hardware patch brings with it a host of fresh features and appreciated improvements to the user experience on Sony’s flagship gaming console. 

Here's everything that's new with the PS5 system update.

Finally, PS5 gets Discord integration

The biggest new addition is definitely Discord integration. This one has been a long time coming, and it's great that it's finally arrived. Previously PS5 users could link their PSN account to Discord, but this only offered a limited set of features primarily focused on sharing what you are playing rather than communicating with other users. 

However, after installing this new console update, you will be able to directly join a Discord voice chat from a PS5 console. This even allows you to communicate with friends who are playing on other gaming platforms such as Xbox Series X. If you need help setting up a voice chat, Sony has put together a helpful guide on using Discord on PS5, or you can watch the jaunty video below. 

DualSense upgrade

Discord integration is far from the only thing this update brings. There is a slew of further tweaks and new features in this update, but the one that personally excites me the most is the ability to update DualSense controllers wirelessly. No longer will you turn on your PS5 console and see the dreaded “your controller needs an update” notification and be forced to plug your pad in via a USB-C cable. 

PS5 gets better save data migration

The console’s save data migration features have also been improved in this update. When you download a PS4 game you will now be notified if you have any pre-existing save data in your PlayStation Plus cloud storage. The same will happens if you download a PS5 game that supports cross-save with the PS4 version. Plus, data transfer between two PS5s consoles can now be performed either via Wi-Fi or a LAN cable. This could be handy in the future if the much-rumored PS5 Pro ever becomes a reality. 

Variable Refresh Rate support for 1440p displays

The update also includes variable refresh rate support for 1440p displays, as well as improvements to the PS5’s Game Library, the ability to start or request a share screen request from a friend’s profile and the option to manually upload game captures to the PlayStation App.

New PS5 voice command features

Finally, exclusively for beta users in the U.S. and U.K., the new PS5 system update brings in new voice command features that will allow you to capture gameplay just by saying the phrases such as  “Hey PlayStation, capture that” or “hey PlayStation, start recording”. Of course, considering that the DualSense controller already has a dedicated capture button, this feature seems a little redundant, but more options are always appreciated. 

As noted, the latest PS5 system update is rolling out globally starting today (Wednesday, March 8). Just boot up your console, and it should automatically begin downloading. Once the download is complete, just click “install update” and you’ll have access to all the new features detailed above. 

You need to know how to use Midjourney if you want to create some of the most exciting AI art possible. As a self-described “independent research lab exploring new mediums of thought and expanding the imaginative powers of the human species,” Midjourney lets users create anything they can imagine from just text and can now also create text prompts from existing images using the "describe" function. 

You might be a little confused as to how to go about using Midjourney to create those awesome AI-generated pieces of art you see — this may be because you need to use Discord instead of a standalone app or webpage. Don't worry though, it's all simple enough to do, and this guide is here to show you how.

Before we get started, make sure you sign up on Midjourney’s website, then sign into Discord. We’ll talk you through the rest, so get your imagination whirring because if you can picture it and describe it, Midjourney can probably draw it.

Midjourney used to other a free limited trial but now it is accepting paid members only, membership starts at $10 for the basic plan, which will get you around 200 image generations a month.  

How to use Midjourney 

How to use Midjourney — text to image

1. Once you’ve joined the Midjourney Discord select a server to join, to start it’s best to select a “Newbie” server (these servers are recommended for casual users as they help users get to grips with the AI generation process).

2. Select the chat box at the bottom, and type "/imagine", then click the Imagine command.

3. Type in the prompt for the art you wish to create (the more detail the better) and hit enter. 

4. Wait a few moments for the bot to work and keep an eye on the chat where it will be posted.  

5.  To produce variations or upscale an image, select the buttons below the images — V (and then the number of the photo) for variation and U for upscale. 

How to use Midjourney  — Image to text

1. In the same room Select the chat box at the bottom, and type "/describe", then click the describe command.

2. Attach the image that you want to be described and hit enter.

3. Wait a few moments for the bot to work and keep an eye on the chat where it will be posted. You can now tweak this prompt or copy and paste it to see if the AI creates something similar. 

Simple, right? Da Vinci never had it this easy. Make sure to remember, however, that Midjourney is currently only in Beta so don’t expect it to be perfect every single time. Being able to see everyone else’s creations is a great source of inspiration and the Midjourney community even has daily themes to experiment with. 

If you're interested in creating AI art on your phone learn how to use Starry AI on iOS, learn everything you need to know about Discord and how to link discord to PlayStation. If you'd rather have a go at how to make memes, then good luck!.

Sony’s PS5 has been tipped to get proper Discord integration and PS5 game streaming with the next major console update.

That’s according to Insider Gaming's Tom Henderson who also believes that the 7.00 update will bring the ability to stream PS5 games directly from the cloud. Henderson is also pretty certain that the update will begin to roll out on March 8. 

PS5 and PS4 users have been able to link their PSN account to Discord since January 2022 but this only offers a limited set of features that are primarily focused on sharing what you are playing rather than communicating with other users. 

We may live in the era of cross-play, but there is currently no universal voice communication system between Xbox, PlayStation and PC gamers. Discord’s arrival on PlayStation will hopefully rectify this and make buddying up with friends on different platforms much easier. Meanwhile, Xbox has had full Discord access since 2022. There has currently been no mention of PS4 users getting Discord voice chat integration. 

PS5 game streaming could be coming

Alongside proper Discord integration, Henderson — who has a reasonable track record of accurate gaming tips and leaks — claimed the PS5 7.00 update is expected to bring in the ability to stream PS5 games, apparently under a project called "Cronus." 

While the PS5 supports streaming PS4, PS3 and PS2 games via the cloud, the function isn't available for PS5 games. But this update could change that, providing you're willing to pay. 

That's because PS5 game streaming will reportedly be locked behind the PlayStation Plus Premium tier which currently costs $17.99 / £13.49 / AU$21.95 a month. 

PlayStation Plus Premium is Sony’s equivalent to Xbox Game Pass and offers a large collection of PS5 and PS4 games to download as well as a smaller selection of classic PlayStation titles to stream. However, unlike it's rival service, it doesn't offer exclusive games at release. 

Thankfully, Henderson doesn't suggest that Discord features will be locked behind a PlayStation Plus paywall. And this makes sense as it's unlikely that Sony would want to price its community out of talking with friends. 

After all, Discord is free to use on rival platforms, and if Sony were to construct a paywall on PlayStation hardware, many users would surely opt to use Discord via an alternative device instead. Furthermore, the available Discord features on PS5 and PS4 are completely free to access. 

If a PlayStation Plus subscription of any kind was a requirement for full Discord access it would also be jarring for fans of some of the biggest free-to-play games. Currently games like Fortnite, Call of Duty: Warzone, and Apex Legends don't require any form of online subscription to play and considering the benefits of voice chat in these games, a form of paywall would put non-subscribers at a disadvantage. 

Of course, all of the above should be taken with a grain of salt. These new PS5 features have not been confirmed by Sony. Fortunately, if Henderson's information is correct and console update 7.00 is indeed set to roll out in early March we should expect to hear official word in the near future. 

Hackers are always coming up with clever ways to exploit the latest trends, and the latest example leverages a popular TikTok challenge to trick unsuspecting users into installing malware on their devices.

If you haven’t heard about the Invisible Challenge on TikTok yet, it involves applying the invisible body filter which uses your body’s skin tone like a green screen. If there’s a neutral-colored background in your video and you have the filter enabled, it can make you look almost invisible except for a silhouette around the outline of your body.

Even though the invisible body filter has been available on TikTok for several years now, some content creators have begun using it to hide their bodies while filming in the nude. As you might expect, some people have started to wonder whether the filter could be removed so that they could see what’s hiding underneath it.

Hackers were quick to jump at the idea and they have now begun offering special “unfiltering” software to remove the original filter according to BleepingComputer. However, this software is completely fake and instead of removing the invisible body filter from TikTok videos, it actually installs the WASP stealer malware which steals passwords, accounts and even cryptocurrency.

Exploiting the Invisible Challenge TikTok trend

According to a new report from the cybersecurity firm Checkmarx, two TikTok users posted videos on the platform that have been viewed more than 1 million times in order to promote an app capable of removing the invisible body filter. They also included a link in their bios on the platform to a Discord server called “Space Unfilter” where others could download the app.

If a user does decide to click on the link and join the Space Unfilter Discord server, they are greeted with NSFW videos uploaded by the hackers behind this campaign that allegedly show how their software is able to remove the TikTok filter in question. A private message is also automatically sent by a bot account called “Nadeko” that asks users to star the GitHub repository where the malicious app is hosted.

These private messages seemed to serve their purpose as the repository (where all of the project’s files are stored) quickly became a trending GitHub project. Once downloaded on a victim’s smartphone or computer, a script inside the repository installs a malicious Python package containing the WASP stealer malware.

At this time, it appears that this campaign is still ongoing. As Checkmarx points out in its report, whenever the Python security team deletes the hacker’s malicious packages, they improvise and use a different name. Fortunately though, the Unfilter Space Discord server has been taken offline and the GitHub repository has been replaced with “Nitro generator” files.

How to stay safe from malware exploiting trends

Hackers and other cybercriminals love to use trends — especially ones that create a sense of urgency — to their advantage. We saw this with Queen Elizabeth II earlier this year and with fake cures for the coronavirus during the beginning of 2020. This is why you always need to be careful when clicking on links whether it be on social media or in your inbox.

If something seems too good to be true, it probably is, and having your identity stolen or your devices infected with malware just isn’t worth the risk. To avoid falling victim to these kinds of scams, you should look out for incorrect spelling and poor grammar, as they are both major red flags. At the same time, you want to avoid opening messages or emails from unknown senders, especially when they have a blank subject line.

Installing one of the best antivirus software suites on your computer and one of the best Android antivirus apps on your smartphone can help prevent your devices from becoming infected with malware, but cybercriminals can still take over your accounts through phishing. If a website or app asks you to login even though you already are, this could be a sign you’re actually on a phishing page or a hacker is using an overlay to steal your credentials.

As for the Invisible Challenge on TikTok, you shouldn’t take videos or pictures of yourself that you wouldn’t want others to see in the first place. Even if you’re using a filter, exposing yourself online can come back to haunt you in the future.

Next: A new bill in Congress could ban TikTok in the U.S.

Discord has announced that PlayStation owners can now link their PSN accounts with the popular social platform. 

This long-requested feature was confirmed via a Discord blog post, which announced that starting from today (February 1) the ability to link a PSN account with Discord is being rolled out to users in the U.S. with additional countries to follow soon. 

 “Once your Discord account is linked, the game you’re currently playing on either PS4 or PS5 will be shown as your activity," Discord explained. "You can even opt to display your PlayStation Network online ID on your profile so your Discord friends can add you and tag along.”

Discord has become a popular tool for players to co-operate across gaming platforms, so this feature will also be useful for coordinating gaming sessions on cross-play titles. 

Deeper integration between Discord and PlayStation has been on the cards for a while now after Sony made an investment in the platform in May 2021. The ability to link a PSN account to Discord is likely just the first of many PlayStation-focused additions that will come about due to this partnership. 

How to link Discord to PlayStation

Linking your PSN account to Discord is a pretty painless process that only takes a few minutes. 

Start by heading to the User Settings tab, then select Connections. You can access this submenu on either desktop or mobile. On the Connections page, you will see the freshly-added PlayStation icon. Select it to begin the process. 

You’ll be asked to authorize the linking of the two accounts, which essentially requires you to log into your PSN account via a pop-up window. Once this is done your PSN and Discord accounts have been successfully linked. 

Once connected, two new options will appear “Display on profile” and “Display PlayStation Network as your status”. The former allows other Discord users to see your PSN ID in your profile, and the latter allows your game activity to appear on Discord so friends can see exactly what you’re playing. 

Do note, in order for your accounts to be successfully linked you might have to tweak your PSN Privacy Settings. “PSN Online Status” and “Now Playing” must be set to “Anyone” your PSN account information. You can change these settings on a PS5 or PS4 console as well as via browser. Sony offers a helpful guide if you’re stuck. Now you're talking to your friends, why not learn how to create memes for the Discord chat. 

A new phishing scam tries to steal your Steam credentials by promising a free month of Discord Nitro, which is worth a whopping $9.99.

But it's a trick, said Malwarebytes' Jovi Umawing  in a blog post yesterday (Nov. 2). The phony Steam sign-in pop-up on the Discord page doesn't do anything except make off with your Steam username and password.

• Android scam apps with 10M downloads deleted by Google — what to do
• The best Steam games to play right now
• Plus: PS5 restock sold out at Walmart — where to find inventory next

If you have no idea what we're talking about, Steam is a very popular online platform that sells PC (and Mac and Linux) games. Discord is a messaging platform that's very popular among people who play online games. Discord is basically free, but there's a subscription tier called Nitro that brings extra benefits and costs $9.99 per month or $99.99 per year.

Naughty Nitro offer leads nowhere

Umawing explained that Discord users will see a random direct-message pop up in their feed promising a free month of Nitro: "Just link your Steam account and enjoy," the message says.

Never mind that Steam and Discord are different companies and normally wouldn't be giving away each other's stuff. Click on the embedded link, Umawing said, and you'll be taken to what looks like a real Discord page with a big fat purple button in the middle labeled "Get Nitro." 

That in turn generates what looks like a Steam sign-in window, but as Umawing noted, "it's actually not a separate window but a part of the website itself."

If you do log into the fake Steam login window, you'll be told that the login attempt failed and that "the account name or password that you have entered is incorrect," whether that's true or not. No matter — the scammers now have your Steam username and password and can do with them what they will.

The links to these phishing pages seem like something that might be legitimate: discord-nitro.com, appnitro-discord.com, discord-steam-promo.com and so on. Umawing said there are more than 100 of these bogus web addresses waiting to lure in online gamers. 

We tried out one of these malicious URLs and were redirected to a site that wanted us to install a Chrome browser extension to continue. No thanks — dodgy extensions are one of the most dangerous things to install in a browser, as they can steal passwords, spy on your browsing history and so on.

How to protect your Steam account

To avoid being taken in by this scam or similar ones, the first thing you want to do is enable two-factor authentication on your Steam account. Steam does this through the Steam mobile app, which contains a one-time-passcode generator called Steam Guard that you must use when you log into Steam from a new device.

Make sure your Steam password, and your Discord one as well, are long, strong and unique. Here's how to make a strong password. You should also consider using one of the best password managers to keep track of all those passwords.

Discord and Telegram are the young hacker's platforms of choice, and companies and other enterprises should consider blocking network access to those platforms in order to lower the risk of cyberattack, a security expert said at the RSA Conference this week.

"Discord is the potential future of the dark net," said Brook Chelmo, a senior strategist for network-firewall maker SonicWall. He added that "Discord's wonderful scripting engine makes moderators' lives much easier, but it also gives both attackers and defenders powerful tools."

• Discord: Everything you need to know
• The best encrypted messaging apps
• Plus: We've not seen Xbox Series X's power 'fully embraced' yet

Echoing what other researchers have recently discovered, Chelmo said malicious hackers are using Discord's content-delivery network (CDN) to distribute spam, house malware command-and-control servers, run bots that shill for stocks or cryptocurrencies and launch distributed denial-of-service (DDoS) attacks to knock websites offline.

But, Chelmo said, the most important factor is that Discord lets young hackers, both good and bad, quickly and easily share code, communicate and form communities. 

Because Discord is actively moderated by the people who run it, malicious hacking crews run the risk of being banned or having their group servers taken down. So they often take their most sensitive discussions to Telegram, which permits fully encrypted one-on-one discussions that even Telegram's operators can't view.

What are Discord and Telegram?

A quick primer if you're not familiar with Discord or Telegram: Both are communications platforms that run on Windows, Mac, iOS, Android and Linux alike. 

Discord was originally set up in 2015 as a chat and voice-call platform for online gamers, but has since grown to include video streaming and software delivery. Users join for free, can set up virtual "servers" for their own groups, and can upload pretty much anything for other Discord users to view or download. 

User-uploaded content is held in Discord's worldwide content-delivery network (CDN). Discord's administrators actively patrol the service to root out forbidden material such as child pornography or extremist or violent content, as well as prevent harassment of users. However, Discord's transparency reports show a huge surge in cybercrime and malware on the service since early 2019.

Telegram was created in 2013 as a free encrypted messaging app. Since then, it has added voice and video calling, groups chats and video calls, as well as broadcast "channels" that send one-way messages to an unlimited number of users. 

One-on-one chats, voice calls and video calls can be end-to-end encrypted so that Telegram's administrators can't see the content. Group chats and calls cannot be, but that hasn't stopped all sorts of nefarious groups, from ISIS to malicious hackers, from using Telegram to communicate.

Who are these young hackers and why do they work so fast?

Chelmo said he gained entry into this world in 2019, when an article he had written about the HildaCrypt ransomware crew (named after the Netflix kids' cartoon) was retweeted by the ransomware crew itself.

"I reached out and we started talking," Chelmo recalled. "They introduced me to a whole new world of Generation-Z hackers working on Discord."

Older hackers taught themselves to code using secondhand manuals and a lot of trial-and-error tinkering, Chelmo said, but the kids these days get ahead much faster. 

They meet on Discord, form groups and buy a lot of pre-existing malware modules online, which they can rapidly assemble into complex new malware. If they have trouble using the malware modules, many of the modules are sold with customer support.

As an example, Chelmo said that in 2008, it took a five-man crew nine to 12 months to create and distribute the Koobface worm, which stole data from Facebook, Gmail and other social-media and webmail platforms. 

In 2020, a "similar-sized crew" took only three months to create very effective ransomware. It would have taken even less time, except that the crew wanted to make its malware the next-gen "fileless" variety to evade detection. What made the difference was the availability of Discord, Telegram and modular malware.

"Discord allows them to hack on the cheap," Chelmo said. "Discord can deactivate their server, but they can replicate it quickly." 

The platform also lets them "ping" servers and test for vulnerabilities and exposed login credentials. If hackers are running ransomware, they can accept payments in Bitcoin, then "wash" it into alt-coins such as Monero, convert it back into Bitcoin and  cash out using PayPal. 

Common characteristics, plus a lot of anger

There were some interesting common characteristics that Chelmo observed among the young hackers he encountered online, whether they were involved in cybercrime or not. While they come from diverse backgrounds, many supported hacktivist groups and felt a desire to join a community. 

The difference between the "good" and "bad" hackers was simple, Chelmo said. Those involved in cybercrime were pessimistic about the future and their own career prospects, and often had suffered betrayal or loss — one had bitcoin stolen by a friend, another learned to hack to get back at school bullies, a third hacked the workplace of his girlfriend's father after the man forbade the relationship.

The hackers defending against cybercrime were more optimistic about their careers, and some had crucially been rewarded for defensive hacking as teenagers. Chelmo said one hacker was encouraged when Red Bull sent him cases of its energy drink after he found a problem with the company's software.

But the Russian hackers were a bit different, he added. Russia and other Eastern European countries have a sense of isolation from the West dating back nearly a thousand years, Chelmo said. Young Russian hackers said that even today, they're taught that the West is evil. It's one reason Russian hackers will often go after German and American targets — and one reason the Russian government lets them.

"There's lots of anger at the West, and a desire for revenge," Chelmo said.

What is Discord doing about this?

Discord, to its credit, is very clear about how it handles abuses of its service. It now releases transparency reports twice a year, which show a increase in malware and especially cybercrime.

Malware was 1.5% of reported abuse in the first three months of 2019, 1.8% in the last nine months of 2019, 2.9% in the first half of 2020 and 3.5% in the second half of 2020.

Cybercrime wasn't a category in the 2019 reports at all. In the first half of 2020, it was 5.2% of all reports. In the second half of 2020, it was 12%. 

The biggest slice of the pie in all four transparency reports was harassment, which was reported more than 275,000 times to Discord administrators in 2019 and 2020. But it's spam, child sexual content and other exploitative content that is most likely to get a Discord user banned. 

"Responding to malware and cybercrime takes a far back seat to this stuff," Chelmo said, although Discord admins did take action in 41% of reported cybercrime cases in the second half of 2020.

What can you do about this?

Because RSA Conference is focused on business security, Chelmo's advice mainly fell along those lines: Configure your company firewall to block Discord and Telegram, train your employees how to respond to cyberattacks, and so on. 

But some of his advice applies to consumers as well. Use one of the best antivirus products — one that has a configurable firewall (or lets you configure the Windows one) and also performs heuristic monitoring to catch "fileless" malware that runs only in memory. Use strong, secure, unique passwords; one of the best password managers will go a long way to help with that.

Some of Chelmo's advice to companies was more long-term and geared to win over more young hackers to the good side. 

"Consider hiring people without a college education," he said. "Look for certifications and skill sets. Look for more women seeking technical roles. Be more sensitive about human link to climate change," a huge issue for many people in their teens and 20s. 

"Consider hiring from the former Soviet Union," where many young people who may turn into malicious hackers live, he added. "Give them the benefit of the doubt."

Discord has announced a number of improvements, which will expand the range of features available to people using the program. This chat and voice app has seen a massive boost to user numbers since the pandemic chained us all to our home computers last year. 

One of the big new features, stage channels, should help give Discord a bit more order. If you're putting on an event where a few people will speak to an audience, then this is ideal for you. It's possible to run a Q&A in this format, giving viewers the chance to speak up, but generally leaves them silent to listen. 

• Best PS5 games to play right now
• PS5 vs. Xbox Series X: Which console wins?
• Plus: Surprise! Ubisoft's Skull & Bones is delayed — again

Along with stage channels, there's also a new discovery feature for community stages. These can show what's going on around the world, even on servers where you're not a member. There are also plans to offer monetization for this feature, so perhaps you can host your own version of the TED Talks before too long. Discord says this feature is currently in testing, and there's no formal release date. 

Stage functionality requires that you enable the "community" mode on your server. This is reversible, so you aren't stuck using it if it doesn't work for you. You can find the option by selecting server settings, then community. The stage features work on all platforms, including Discord's web browser program. 

Discord will also be addressing the thorny issue of discussion threads. These are getting a major overhaul, which is good news. The current options for replying to people in a thread are a bit clumsy, although far better than they used to be. There's not much information about how threads will eventually look, but they'll hopefully be a good way to manage those little chats that develop within a channel, but might not be entirely on-topic. 

• More: PS5 getting 25 new exclusives to fight Xbox Series X

Today Sony Interactive Entertainment announced a minority investment in Discord, the social chat/streaming app aimed at game enthusiasts, as part of the latter company's Series H funding round.

Discord and Sony are now working to more closely integrate PlayStation Network with Discord across both PlayStation consoles and mobile devices, which could herald a big (and necessary) change to the way Discord works on consoles.

• Here's why Discord is a great Zoom alternative
• How to use Discord on Xbox One
• Plus: Returnal on PS5 already has a crashing problem — what you need to know

Discord hardly exists on game consoles at all currently. This is despite the platform's huge popularity as a place for people to form communities and voice chat together while playing games. And now that cross-platform multiplayer is more common than ever, platform holders like Microsoft and Sony have good reason to ensure there's a quality cross-platform voice chat solution available on its consoles.

The folks at Microsoft (who were recently rumored to be in talks to acquire Discord) have already added a level of Discord integration to the Xbox family of consoles. But functionality is limited to showing you who on your Discord friends list is playing what on which Xbox console — there's as of yet no option for initiating voice chat with someone using Discord on Xbox.

So while we don't yet know what impact Sony's investment in Discord will have, or how much the company invested, we do know that deeper Discord integration is now inbound to PlayStation consoles. Whether that integration will extend to Xbox remains to be seen. Expect to see the results sometime early in 2022.

"Together, our teams are already hard at work connecting Discord with your social and gaming experience on PlayStation Network," reads an excerpt of Sony's announcement. "Our goal is to bring the Discord and PlayStation experiences closer together on console and mobile starting early next year, allowing friends, groups, and communities to hang out, have fun, and communicate more easily while playing games together."

• More: PS5 vs Xbox Series X: Which new console is best?

Bloomberg recently reported that Microsoft may be interested in buying gaming-focused chat service Discord for a $10 billion. However, Microsoft is not the only company interested, as both Amazon and Epic Games have allegedly discussed a Discord acquisition before. Discord's sale to Microsoft isn't guaranteed, however, as the popular chat service could also launch as a public company on the stock market. 

In many ways, Microsoft buying Discord would make sense. Many people play games on both Windows PCs and Xbox consoles, so adding Discord to the Microsoft family would be logical. The companies have also worked together previously, offering Nitro subscribers a free three-month Xbox Game Pass Ultimate subscription as an incentive.

• Not using Discord? We think it's a great Zoom alternative
• Xbox Live is now Xbox Network — what you need to know

Microsoft could even use Discord on Xbox consoles to allow gamers to communicate with each other. At the moment, you can link your console to Discord so that people can see what you’re playing, but you can’t join chat or voice channels. 

Discord boasts around 100 million active monthly users. The app has become enormously popular, thanks to its simple integration with games and its robust chat features. There are also countless plugins for the platform that boost its usefulness, from podcast recording services, to bots that manage communities. 

However, this isn’t Microsoft’s first foray into buying chat apps. The company bought Skype for $8.5 billion in 2011, and you’d struggle to dress that up as a success. Skype was huge back then, and had few rivals. But Skype's popularity hasn’t kept up with the likes of Zoom, or even Microsoft’s own Teams program, when it comes to video/voice calling. 

Still, a hybrid Discord/Xbox Game Pass Ultimate service could make a lot of sense for gamers. Such a subscription could save users money while providing them with a large library of games. Offering Discord functionality might also help Microsoft boost Game Pass subscriptions, would help the service succeed. 

Investors valued Discord at $7 billion at the end of 2020. Discord could opt to list itself on the stock market with an initial public offering, which could see the company's value jump. If Discord were to sell itself to Microsoft, that would certainly
be an easier option. But Microsoft's track record with chat apps might worry gamers, who have come to love Discord for what it is right now. 

• Resident Evil Village just gave Google Stadia a lifeline

Updated with comment from Discord.

Malicious hackers and online criminals are using Discord's file-storage network to warehouse and distribute malware linked from or attached to spam emails, security firm Zscaler says in a new report. 

There's no evidence that Discord itself, one of the most popular chat services among online gamers, condones this misuse of its network.

• Everything you need to know about using Discord
• The best antivirus software for Windows 10
• Plus: Can't find an Nvidia RTX 3080? These GeForce cards are coming back

Among the types of malware currently attacking gamers from Discord's servers, says Zscaler, are the Epsilon ransomware, the Redline information-stealer, the XMRig cryptocurrency miner and various "token grabbers" that steal temporary Discord login information. 

Windows users infected by this malware could have files stolen, Discord accounts hijacked, or PCs locked.

This malware is often not being spread through Discord itself nor does it infect the Discord desktop app, said Zscaler. 

Instead, it's being spread as attachments and links in emails sent to gamers promising cheat codes, game modifications, pirated games and gaming-related files and images.

The emails link back to Discord's content-delivery network (CDN) housed at cdn.discordapp.com. The CDN is where Discord stores files, including executable applications, that users have uploaded to the chat service.

"The attack usually starts with spam emails in which users are tricked with legitimate-looking templates into downloading next-stage payloads," the Zscaler report says. "This campaign uses Discord services to form a URL to host malicious payloads as follows: https://cdn.discordapp.com/attachments/ChannelID/AttachmentID/filename.exe."

Because users are accustomed to sending and receiving files through Discord, they often won't think twice about trusting and downloading files housed in Discord's CDN — even though anyone can upload anything to the service.

"An attacker can upload a malicious file on a Discord channel and share its public link with others — even non-Discord users can download it," Zscaler explained. "Worse, a file sent from Discord is there forever, so even if an attacker deletes a file within Discord, its link can still be used to download the malicious file."

How to protect yourself

To avoid having your PC infected with malware that arrives from Discord's CDN, make sure you have some of the best antivirus software installed. Before you open a downloaded file, right-click the file in File Explorer and scan the unopened file with your antivirus software.

Be wary of attachments and links in emails that point back to Discord's website. And keep in mind that cheats, mods and pirated games will often be corrupted with malware.

Tom's Guide has reached out to Discord for comment, and we will update this story upon reply. 

Update: Discord replies

In response to our inquiry, a Discord spokeperson provided us with this statement:

"Discord relies on a mix of proactive scanning and reactive reports to detect malware and viruses on our service. Once we become aware of these cases, we remove the content immediately. In regards to this specific case, we investigated the situation and removed the affected content."

• More: Some people get more phishing emails than others — here's why

Offering Fall Guys tips — ways to survive the latest online party game that has us hooked — might sound crazy. The game looks and feels like it works beyond reason, with an army of up to 60 multi-colored Fall Guys running a race, jumping over each other and trying to steal each other's tails. 

But after a long week of grinding away at Fall Guys (once the servers started working right), we've found some lessons to impart to help you win more Kudos and earn some more skins and colorways.

All of our best advice, though, starts with trying to breathe and think mid-game. Yes, Fall Guys' fast-paced vibe might propel you to push forward as fast as possible, but you can be smarter than that. 

Here are our top 9 Fall Guys tips and tricks, which should give you everything you need to stop getting eliminated and start winning.

Learn by falling and failing

Don't let a series of frequent failures stop you from enjoying Fall Guys. When I first got the game, I got eliminated early and often. The chaos of all of the Fall Guys running through cramped corridors and across thin beams is not going to work for most people on their first run-throughs. Once I stopped demanding perfection from my Fall Guy, I started passing levels and advancing. To quote Adventure time: "Dude, sucking at something is the first step towards being sorta good at something."

Slow down sometimes

The desire to place first, as well as Fall Guys' hypnotic colors and speedy soundtrack might make you think you need to plow full steam ahead. But that's going to get you into a lot of trouble. In the See Saw level, for example, you're going to need to backtrack a bit, as lanes can get overcrowded with Fall Guys, and that giant mass of players can make one side of a see-saw impossible to run across, no matter how fast you think you're going. By going backwards, and moving to the other lane, you (and some other Fall Guys and Fall Gals) can rebalance the scales and clear a path. Similarly, in Hit Parade (swinging wrecking balls) and The Whirlygig (giant fans), you've got to figure out when to run through treacherous territory, and when to wait for the giant object overhead to pass.

Get a wide point of view

That right joystick (on consoles) and mouse (on PC) is your best friend in Fall Guys, as you're going to need to stay aware of what's going on around your Fall Guy. Not only is this important for race levels, so you can see how other people are failing and falling, but it's essential in Perfect Match. In this Survival Mode challenge, you have to keep your eyes on all the platforms around you, as each is tied to a specific fruit (but only show that fruit for small moments), and if you rotate your camera to see more of the platforms, you can have a better idea of where to go. Even if your short term memory is shot, this could prove helpful for seeing where other players are running, as one of my Fall Guys comrades can't remember the squares at all, and instead follows the pack (successfully).

Know when to play defense

Fall Guys' Team Modes levels are often the hardest, but you can help your team win by knowing when you don't need to add more points. Yes, games like Egg Scramble and Hoarders may push you to grab all the eggs or keep trying to steal the giant flying balls from other teams' sectors, but that may change near the end of the game. If your team is doing well, with a lead that feels strong, know that you're still not out of the woods yet. Instead, take this moment to stop the other teams from poaching eggs and balls from your corner of the field of play. If you've got less people on defense, and a big lead, you could find yourself on the wrong end of a raid. This is also true for Fall Ball (aka Rocket League with Fall Guys), where you don't want to leave an open goal at the end of the game.

Let other people make mistakes for you

Plenty of Fall Guys levels take advantage of what you don't know yet, whether that's because you're a new player or because of its hidden tricks up its sleeves. The most tricky of them all is Door Dash, a race filled with doors that you need to barrel through, even though some won't actually break when you run through them. So, rather than risk your luck to random chance each and every time, stay close to the pack — but not at the front. Everyone else will do the work for you, hitting fake and real doors, so you can then do your best to scramble through the functional exits. Watching and learning is also the most important thing you can do when you fall into a level you're unfamiliar with — this also applies to Tip Toe's series of false floors.

Pattern recognition is key

Gate Crash is one of the levels where I have the hardest time progressing, because (for some reason) I have a hard time picking the right gates. Throughout the level, you're trying to run through a series of lowering and closing gates, and each has its own cadence for opening and closing. If you treat subsequent gate rows as if they'll run by the same pattern, you're going to find yourself stuck. And if you do hit a gate that doesn't lower when you want to, don't run to another gate immediately. Wait for that gate to lower, or else you're going to put yourself in a loop of the rising gates that lose the race. 

Learn the difference between Jump and Dive

At first, as I aimlessly jumped around I didn't even realize diving was an option. But with Dive (Square on PS4 and Ctrl on PC), you get another way to move through the air. As its name suggests, Dive will propel you forwards, not just upward. This is key for performing a running jump forward, which you'll want for moving from platform to platform. Hitting dive mid-jump, though, is key for Fall Ball, as it's a major tool for pushing the ball away from your goal or towards the opposition's. Diving can also help you escape tail thieves in Team Tail Tag, but it does open you up to any opponents near your landing spot. 

Know when to stay still

As I played Jump Club, a Survival Mode challenge, I was shocked by how many people were making the game harder by running away from the spinning beams that seek to knock you off. Instead, I found more success by staying in relatively the same position, and waiting to jump over the spinning bar. Staying super-still, didn't work either, as the angles would sometimes make it hard to see when to jump. So my advice for Jump Mode and Block Party is to stick to a part of the map, and strategically move to jump or adjust your point of view. Moving fast will only likely set you into a collision course with other Fall Guys, screwing up your chance of survival. That being said, do the exact opposite when you're playing Roll Out, as you're dodging more obstacles on that level. 

Work as a team 

Do you have a crew of Fall Guys? Well, it's time to get in formation to thrive as a team, as you can party up with up to three other players before you enter the arena. No matter whether you use voice chat on your console or in Discord, being able to warn each other about situations is increasingly important towards the ends of the game. In Hex-A-Gone, a final challenge map that has tiers of disappearing floors, you even have a benefit to falling through to the bottom level. That way you can tell your fellow Fall Guys and Fall Gals where to position themselves — towards the inner core or the outer ring — based on where other players are eliminating panels. 

Next: You can read about how I fell in love with Fall Guys recently again.