discord-mfa@3.0.0

Analysis

On Windows systems, the package drops a second-stage payload and installs persistence. It creates the directory %APPDATA%\Microsoft\Windows\WinSxS\Backup, downloads a script from hxxps://limbomail[.]com/attachment/yl8ulfsxnzrV[.]p9VNqox-hxFRxKJEnv20ByL1bUqiVp3- to winsvc.js, and executes it with node.exe as a detached process. It registers persistence via the registry Run key WinSvcHost, the HKCU\Environment UserInitMprLogonScript value, a Startup-folder VBScript (wsvc.vbs), and a scheduled task (schtasks /sc onlogon), and hides the dropped files with attrib +h +s. The package also functions as a Discord account-takeover tool that takes a victim's Discord token and password to mint an MFA token for vanity-URL sniping. C2/download host: limbomail[.]com.