Discord Webhook Exploits – Silent Watcher Compromising Windows Systems and Stealing Data

Cybersecurity researchers at K7 Labs have uncovered a sophisticated new threat targeting Windows systems through an unexpected vector: Discord webhooks.

The Cmimai Stealer, a Visual Basic Script (VBS) based infostealer that first surfaced in June 2025, represents a concerning evolution in malware tactics that leverages legitimate communication platforms for malicious data exfiltration.

VBS-Powered Data Theft Campaign

The Cmimai Stealer operates through a deceptively simple yet effective approach, using native Windows scripting capabilities to avoid detection.

Upon execution, the malware creates a comprehensive logging system in the victim’s temporary folder through “vbs_reporter_log.txt” while simultaneously gathering critical system information via Windows Management Instrumentation (WMI) queries.

The malware’s primary data collection module targets the Win32_OperatingSystem class to extract OS version details, computer names, usernames, and timestamps.

This intelligence gathering extends to browser environments, where the stealer creates and executes PowerShell scripts like “vbs_ps_browser.ps1” to harvest user profile metadata from Chrome and Edge browsers, specifically targeting profile names and email addresses stored in Local State JSON files.

Perhaps most concerning is the malware’s screenshot capability. Through a secondary PowerShell script “vbs_ps_diag.ps1,” Cmimai Stealer captures full-screen images, compresses them to 70% JPEG quality to comply with Discord’s 8MB upload limits, and prepares them for transmission to threat actors.

Evasion and Persistence Tactics

The malware demonstrates sophisticated evasion techniques by circumventing PowerShell execution policies through the “-ExecutionPolicy Bypass” parameter and operating in hidden window modes.

Its persistence mechanism involves an endless loop executing every 60 minutes, ensuring continuous surveillance without user intervention.

Network communications occur exclusively through HTTPS connections to Discord webhook URLs, using a distinctive User-Agent string “Cmimai Stealer VBS UI Rev” that ironically serves as a detection signature.

The malware employs fallback mechanisms, utilizing both WinHttpRequest.5.1 and MSXML2.XMLHTTP objects to ensure reliable data transmission.

Detection and Defense Strategies

Security teams can identify Cmimai Stealer infections through several indicators: suspicious parent-child process relationships between wscript.exe and powershell.exe, temporary files with specific naming conventions (vbs_ps_browser.ps1, vbs_ps_diag.ps1), and unexpected Discord API traffic from enterprise environments.

The malware’s lightweight design deliberately omits advanced features like system restart persistence and credential theft capabilities, suggesting its primary role as a reconnaissance tool for staging more sophisticated attacks.

While currently unattributed to known malware families, Cmimai Stealer’s abuse of Discord’s infrastructure highlights the ongoing challenge of legitimate platform exploitation in modern cyber threats.

IOCs