Hacker News Reader

Comment by sc__ | Hacker News Reader

The article doesn't explain what exactly the "W4SP Stealer" does. Would someone be able to explain?

It downloads a script that, at least right now, will turn around and grab cookies and passwords from browsers and send the data off to an discord webhook.

> discord webhook

Hah. Is this true? I find it funny since IRC has/had this reputation for being a means of communication with malware and it's often blocked on this grounds.

Nice to know that malware is going on with the times and is using Discord for that now.

Discord is great as command and control server because the malware author doesn't need to expose their ip address or implement a complex web of proxy to secure their C&C server.

Couldn't you use someone else's IRC server, the same way you use Discord's server?

I suppose you could, but have you seen how popular new opensource projets being run these days? Young devs really loves discord to the point of hosting documentations there. I imagine young malware authors are no different.

Which, I don’t know if I’m getting old, but man that frustrates me. It’s a terrible platform for documentation. It’s barely a good text chat platform.

You are, yes and yes.

The source is actually hosted on GitHub, and there is a good readme explaining all that :)

https://github.com/loTus04/W4SP-Stealer

If I hosted malware, I would be in jail. It is against the law. I wonder why Github is allowed to host malware, and continues to provide a platform for it?

https://sanctiontrace.com/malware-hosting-providers-sentence...

It's a slew of checks for passwords and other things on the developers machine. The data is extracted and sent to a remote endpoint controlled by the attacker.

Reply on news.ycombinator.com