Discord RAT Delivered via Fake Word LNK

Researchers described a real malware campaign where victims are tricked into opening a document-themed attachment that ultimately installs a remote access trojan (RAT). The infection chain uses a PDF that leads to a disk image containing a Windows shortcut (LNK) disguised as a Word document, which launches hidden PowerShell to run the malware. Once installed, the RAT uses Discord for command-and-control and can steal data and run commands on infected machines.

Key findings

• Malware campaign delivers a Rust-based RAT that uses Discord as command-and-control.
• Initial lure is document-themed: a PDF that contains a disk image with a Windows shortcut (LNK) masquerading as a Word document.
• Opening the LNK shows a decoy document while a hidden PowerShell process runs to decode/execute the payload.
• A Nim-based loader drops a Rust DLL and a PowerShell deployment script to temporary files.
• The script attempts to move the DLL into a protected Microsoft Edge directory to bypass Windows User Account Control (UAC).
• Attackers likely use DLL search-order hijacking to load the malicious DLL.
• The RAT performs recon (system/process/network info) and captures screenshots; operators can run commands, manage processes/files, and conduct surveillance.
• Data can be compressed into ZIP archives and exfiltrated via Ngrok; Discord channels may be used per victim.

Who’s being targeted

• Commonly targeted roles: All employees, Executive assistants, Finance, HR, Operations, IT/Security (monitoring and incident response).
• Attack channels: email.
• Impersonated: Unknown sender posing as a business contact sharing a document.

Awareness takeaways

• Treat ‘document-in-a-document’ attachments (PDFs that contain disk images/shortcuts) as highly suspicious and report them before opening.
• Be alert for decoy documents that open normally while something else runs in the background; report unexpected PowerShell or security prompts after opening attachments.
• Legitimate platforms can be abused by attackers, unusual use of Discord/Ngrok by business endpoints should be investigated.

Red flags to watch for

• A PDF that contains (or prompts you to open) a disk image or shortcut file instead of a normal document
• A Windows shortcut (LNK) masquerading as a Word document
• Decoy document displays while hidden PowerShell runs in the background