HackTool:MSIL/DiscordStealer.CG is a credential-harvesting trojan specifically designed to extract Discord authentication tokens from infected Windows computers. Written in managed .NET code (MSIL — Microsoft Intermediate Language), this stealer targets Discord users to hijack their accounts by stealing session tokens stored locally by the Discord desktop application and web browsers. Once an attacker obtains these tokens, they can impersonate the victim, access private messages, join servers under the victim's identity, and potentially spread the malware further through Discord's messaging features.
This threat is classified as a "HackTool" because it's often distributed in underground forums as a ready-made credential stealer for use by other cybercriminals, but it can also be bundled with pirated software, game cheats, or fake Discord "enhancement" tools that unsuspecting users download voluntarily. The "CG" suffix indicates a specific variant detected by Microsoft Defender and other antivirus engines, though the core functionality remains consistent across variants in this family.
Threat Profile
| Attribute | Details |
|---|---|
| Malware Family | Discord token stealer (HackTool category) |
| Platform | Windows (all versions; requires .NET Framework) |
| Language | MSIL (Microsoft Intermediate Language / .NET managed code) |
| Aliases | MSIL/Stealer.DiscordToken, HackTool.DiscordTokenGrabber, Trojan.MSIL.Agent (generic), various vendor-specific names |
| First Documented | Variants in this family have circulated since ~2020; CG variant identified 2022–2023 |
| Distribution Methods | Cracked software bundles, fake game cheats, Discord "nitro generators," malicious attachments in Discord DMs, YouTube tutorial scams |
| Persistence Mechanism | Run registry key, scheduled task, or startup folder shortcut (varies by variant) |
| Primary Capability | Extraction of Discord tokens from %appdata%\discord and browser profile folders; credential exfiltration via HTTP/webhook |
| Data Exfiltration | Stolen tokens sent to Discord webhooks or remote HTTP endpoints; some variants also harvest browser cookies and saved passwords |
| Network Indicators | Outbound HTTPS POST requests to discord.com/api/webhooks/* or third-party paste/log sites; DNS queries for attacker C2 domains |
| File System Artifacts | Random-named .exe in %LOCALAPPDATA%, %TEMP%, or user Downloads; may drop additional scripts or configuration files |
| Removal Difficulty | Moderate — simple persistence, but token theft is immediate; account recovery required post-removal |
How It Spreads
DiscordStealer.CG and its siblings rely heavily on social engineering rather than sophisticated exploits. The most common infection vector is bundled software: users download what they believe is a legitimate game crack, Discord plugin, or "free Nitro generator," only to execute a trojanized installer that quietly drops the stealer alongside (or instead of) the promised application. Because the malware is written in .NET, it's trivial for attackers to recompile and customize it, leading to hundreds of slightly different variants all performing the same core function.
Discord itself has become both the target and the distribution channel. Attackers compromise accounts using previously stolen tokens, then use those hijacked accounts to send direct messages to friends and server members with links to "urgent" file downloads, "exclusive game beta invitations," or "free boost" offers. These messages link to file-sharing services hosting the stealer. Victims who trust the sender's identity are more likely to download and run the malicious executable.
Other distribution methods include:
- YouTube tutorial scams: Videos claiming to show how to get free Discord Nitro or game hacks, with malware-laden download links in the description
- GitHub repositories: Fake open-source tools or game mods hosted on code-sharing platforms, where the compiled binary contains the stealer
- Torrent bundles: Pirated games or software packages with the stealer hidden in the installer or crack executable
- Phishing emails: Messages impersonating Discord support or game publishers, with attachments that launch the stealer when opened
- Malicious browser extensions: Some variants disguise themselves as Chrome or Edge extensions that promise Discord enhancements but steal tokens in the background
What It Does On Your Machine
Upon execution, HackTool:MSIL/DiscordStealer.CG immediately begins scanning your computer for Discord-related data. The Discord desktop application stores authentication tokens in LevelDB databases located in subfolders of %appdata%\discord (or discordcanary, discordptb for other release channels). These tokens are essentially bearer credentials — anyone possessing a valid token can authenticate to Discord's API as you, without needing your password.
The stealer also targets web browser profile directories, searching for Discord tokens saved in Local Storage or IndexedDB files used by the browser versions of Discord. Common browser targets include Chrome, Edge, Firefox, Opera, and Brave. Some variants of this malware family go further, extracting saved passwords and cookies from the same browser profiles to enable attackers to access other online accounts as well. All collected data is typically bundled into a small text file or JSON structure and transmitted to the attacker's infrastructure.
Exfiltration usually happens via one of two methods: a Discord webhook POST request (ironic, since Discord's own API becomes the exfiltration channel) or an HTTP upload to a remote server or paste site. The webhook approach is popular because it requires no custom server infrastructure — the attacker simply creates a webhook on a disposable Discord server and receives stolen tokens as nicely formatted messages. By the time you've finished reading this paragraph, the attacker may already have your token and be logged into your account.
After establishing persistence (usually via a Run registry key or scheduled task), some variants continue running as a background process, monitoring for Discord updates or new logins to capture fresh tokens. This means even if you change your password after infection, the stealer may immediately harvest the new session token when Discord regenerates it. The malware typically disguises its process name as something innocuous like "DiscordUpdate.exe" or "system32.exe" to avoid raising suspicion in Task Manager.
Manual Removal — Step by Step
Disconnect from the Internet
Before attempting removal, physically unplug your Ethernet cable or disable Wi-Fi to prevent the stealer from transmitting any additional data or receiving commands from the attacker. This also prevents your compromised Discord account from being used to spread malware to your contacts during the cleanup process.
Boot into Safe Mode with Networking
Restart your computer and boot into Safe Mode to prevent the malware from loading with its normal persistence mechanisms. Press F8 during boot (or Shift+Restart from Windows and navigate Settings → Update & Security → Recovery → Advanced startup) and select "Safe Mode with Networking" so you can download removal tools in later steps.
Terminate Suspicious Processes
Open Task Manager (Ctrl+Shift+Esc) and look for unfamiliar processes, especially those with random names or running from %LOCALAPPDATA% or %TEMP% directories. Right-click any suspicious process, select "Open file location," note the full path, then end the process. Common disguised names include variations of "discord," "update," "svchost," or random alphanumeric strings.
Remove Persistence Mechanisms
Press Win+R, type msconfig, and check the Startup tab (or use Task Manager's Startup tab on Windows 10/11). Disable any suspicious entries. Then open Registry Editor (Win+R, type regedit) and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Delete any entries pointing to executables in unusual locations. Also check Task Scheduler for tasks with suspicious names or triggers.
Delete the Malware Files
Using File Explorer (showing hidden files and system files via View options), navigate to the locations you identified in Step 3. Delete the malware executable and any associated folders. Check common hiding spots: %LOCALAPPDATA%\{random GUIDs}, %TEMP%, Downloads, and %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup. If files refuse deletion due to "access denied," they may still be running — return to Step 3 and ensure the process is fully terminated.
Run Malwarebytes or Similar Scanner
Download and install Malwarebytes Free (or another reputable anti-malware tool like Emsisoft Emergency Kit). Run a full system scan to catch any remnants or additional payloads you may have missed. Discord stealers are often bundled with other malware like cryptocurrency miners or RATs, so a thorough scan is essential even if you've manually removed the primary executable.
Reset Browser Profiles (if applicable)
If the stealer harvested browser data, consider resetting your browser or at least clearing all saved passwords and cookies. In Chrome/Edge, go to Settings → Privacy and security → Clear browsing data → Advanced, select "All time," and check Cookies and Passwords. For Firefox, use Options → Privacy & Security → Cookies and Site Data → Clear Data. This prevents lingering session hijacking from cached credentials.
Change Your Discord Password from Another Device
Using a clean device (your phone or another computer), log into Discord and immediately change your password. Go to User Settings → My Account → Change Password. This invalidates all existing tokens, including the ones the stealer exfiltrated. Do NOT skip this step — removing the malware from your PC does nothing to secure your already-compromised account.
Enable Two-Factor Authentication
While still on the clean device, enable 2FA for your Discord account (User Settings → My Account → Enable Two-Factor Auth). This adds a critical layer of protection so that even if another token stealer infects you in the future, attackers can't fully control your account without also compromising your 2FA device.
Reboot and Verify Clean State
Restart your computer normally (not in Safe Mode) and reconnect to the internet. Monitor Task Manager for a few minutes to ensure no suspicious processes reappear. Run one final quick scan with your antivirus to confirm the system is clean. Check your Discord account from a browser for any unusual activity — unfamiliar DMs sent from your account, new servers joined, settings changed — and alert your contacts if the account was used to spread malware.
Prevention
- Never download executables from untrusted sources. If someone sends you a .exe file over Discord — even a friend — verify through a secondary channel (text message, phone call) that they actually sent it. Compromised accounts frequently send malware to entire friend lists.
- Avoid "free Nitro" and game cheat sites. Legitimate Discord Nitro cannot be generated or obtained from third-party tools. Any website or video promising free premium features is almost certainly distributing malware.
- Keep antivirus software active and updated. Windows Defender catches most MSIL-based stealers if definitions are current, but consider adding Malwarebytes as a second-opinion scanner for periodic checks.
- Enable two-factor authentication everywhere. 2FA won't prevent token theft, but it significantly limits what an attacker can do with a stolen token, especially for actions like changing account settings or authorizing new OAuth applications.
- Review Discord authorized apps regularly. Go to User Settings → Authorized Apps and revoke access for any applications you don't recognize or no longer use. Some stealers add malicious OAuth apps to maintain account access even after password changes.
- Be skeptical of GitHub/open-source "tools" for Discord. While many legitimate Discord bots and utilities exist, source code repositories are also common distribution points for stealers. If you must use third-party Discord tools, review the code yourself or ensure the project has a strong reputation and many verified users.
- Use a standard user account, not an administrator account, for daily activities. This limits malware's ability to install system-wide persistence mechanisms, though it won't prevent user-level stealers from accessing your personal Discord data.
- Monitor your Discord login activity. Check User Settings → Log Out All Devices periodically if you suspect any compromise. Discord will show you active sessions, though this feature has limitations — already-exfiltrated tokens can be used without showing up in the session list.
Bring It In
Manual malware removal works for straightforward infections, but Discord stealers often travel with companions — cryptocurrency miners, keyloggers, Remote Access Trojans, or even ransomware. If you've followed the steps above and still see suspicious behavior, or if you're simply not comfortable editing the registry and tracking down hidden processes, we're here to help. Our technicians at Computer Repair Roswell handle credential-stealer infections daily, and we understand the urgency of securing your online accounts before additional damage occurs.
We're located right here in Roswell, Georgia, and we offer same-day or next-day service for malware removal jobs. Bring your computer to our shop at your convenience — no appointment necessary for drop-offs — or give us a call at (770) 695-6672 to discuss your situation. We'll assess the infection, clean your system thoroughly, verify your Discord and other accounts are secure, and walk you through prevention measures so you don't end up in the same situation again. Don't let a compromised Discord account become a gateway for identity theft or financial fraud — let's get your computer and your peace of mind back on track.