[Attention] Phishing Attack Targeting Steam Game Players Using Free Discord Nitro Discovered

A Steam phishing attack is occurring via Discord messages, where users link their Steam account and are issued a free Nitro subscription. Hackers have been found to be using it to steal game items.

This phishing scam is being perpetrated by a number of Discord accounts or automated bots controlled by the attackers, sending links that appear to be guides to other users to receive Discord Nitro for free.

The phishing message sent to Discord users said, “Nitro is free for a month, link to your Steam account to use it.

If you click on the “Get Nitro” button, you will see a fake Steam login form, which is almost identical to the legitimate form, but in fact this popup is a new window opened on a phishing page, so when you enter your Steam credentials, they are sent directly to the hacker’s server. The popup is actually a new window that opens on a phishing page, so once the Steam credentials are entered, they are sent directly to the hacker’s server.

When I try to log in, I get an error message saying “The account name or password you entered is incorrect” and I am prompted to log in again.

This dual verification method ensures that there are no typos in the phishing process and that the stolen credentials are correct.

Nitro as bait

Discord Nitro is a paid membership plan for the popular VoIP and instant messaging platform that comes with perks like account customization, content uploads, and server boosts.

Nitro is so popular that we are seeing malware distributed using the same Nitro as bait, as well as ransomware groups demanding Nitro gift codes in exchange for a working decryptor.

Phishing methods are also constantly changing, with new attack methods emerging to trick gamers by using free stuff as bait.

So, when using Discord, you should be suspicious of messages that claim to offer something for free when you click on the URL.

It should be noted that nothing is offered for free outside of the platform itself, so if Steam and Discord run a promotional campaign together, it will appear in one of their official apps/websites.