In May 2023, the Trellix Advanced Research Center discovered a new Golang stealer, known as Skuld, that compromised systems worldwide.
Skuld
Skuld is a Golang-based Windows infostealer focused on Discord theft but equipped with broader credential and data-harvesting functionality.
Profile source: Mallory opens in a new tabSkuld
Family profile
Skuld is a Golang-based Windows infostealer focused on Discord theft but equipped with broader credential and data-harvesting functionality. First observed in 2023 and later reused in other criminal operations, it has been distributed both as an open-source proof-of-concept and as an operational payload in live malware campaigns, including deployment alongside AsyncRAT and use by HexaLocker V2 prior to ransomware encryption.
Skuld targets Discord tokens, Discord two-factor backup codes, browser-stored credentials, cookies, browsing history, download records, payment-card data, cryptocurrency wallets and wallet extensions, gaming-session data, saved Wi-Fi information, screenshots, host profiling data, and files from predefined sensitive locations. Reported variants also include Discord injection features that intercept authentication and account-change workflows, mechanisms to bypass protections such as BetterDiscord and Discord Token Protector, and wallet-focused theft including mnemonic phrases and passwords from selected wallets. Some builds include clipboard hijacking for cryptocurrency theft.
The malware incorporates multiple anti-analysis and defense-evasion features, including anti-debugging, anti-VM checks, fake error dialogs, process-based security-tool interference, and attempts to disable or weaken Windows Defender. It has also been described as using a UAC-bypass technique via fodhelper.exe to gain elevated access and steal data across user contexts. Persistence at system startup is supported in some versions.
Skuld is best classified as an infostealer. It has been associated with an actor using the alias Deathined, and code and behavioral overlaps have been noted with other open-source stealers and grabbers such as Creal Stealer, Luna Grabber, and BlackCap Grabber. Its availability as source code and modular theft capabilities have made it attractive for reuse by other threat actors targeting Windows users, especially Discord users and victims with browser-stored credentials or cryptocurrency assets.
Capabilities
- Credential Theft
- Crypto Theft
- Defense Evasion
- Exfiltration
- Persistence
- Privilege Escalation
- Reconnaissance
- Session Hijacking
- Spoofing
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
Skuld in ATT&CK
37 distinct techniquesTechniques
37 techniques T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control T1056 Input Capture T1562 Impair Defenses T1539 Steal Web Session Cookie T1056.003 Web Portal Capture T1497 Virtualization/Sandbox Evasion T1005 Data from Local System T1548 Abuse Elevation Control Mechanism T1555.003 Credentials from Web Browsers T1555 Credentials from Password Stores T1528 Steal Application Access Token T1547 Boot or Logon Autostart Execution T1562.001 Disable or Modify Tools T1115 Clipboard Data T1036 Masquerading T1649 Steal or Forge Authentication Certificates T1622 Debugger Evasion T1082 System Information Discovery T1020 Automated Exfiltration T1113 Screen Capture T1489 Service Stop T1016 System Network Configuration Discovery T1217 Browser Information Discovery T1204.002 Malicious File T1033 System Owner/User Discovery T1567 Exfiltration Over Web Service T1059.007 JavaScript T1083 File and Directory Discovery T1102.003 One-Way Communication T1560 Archive Collected Data T1057 Process Discovery T1012 Query Registry T1111 Multi-Factor Authentication Interception T1573.002 Asymmetric Cryptography T1071.001 Web Protocols T1068 Exploitation for Privilege Escalation
Reporting
Research mentioning Skuld
May 19
Trellix
Skuld: The Infostealer that Speaks Golang
Trellix disclosed technical details on Skuld, a Golang-based infostealer linked to an actor using the alias Deathined, after observing infections affecting systems globally. The malware targets Discord, Chromium- and Gecko-based browsers, and the local host, harvesting tokens, browser data, system and network information, screenshots, backup codes, and in some variants local files. Researchers said Skuld also injects JavaScript into Discord and can bypass protections from BetterDiscord and Discord Token Protector. The report said Skuld uses anti-analysis and anti-VM checks to hinder investigation and evade security tooling, while exfiltrating stolen data primarily through Discord webhooks and in some cases Gofile. Trellix assessed the malware remains under active development, noting that some capabilities, including a clipper and parts of its Discord injection logic, appear only partially implemented. The analysis also found strong code and behavioral overlap with open-source stealers and grabbers including Creal Stealer, Luna Grabber, and BlackCap Grabber, indicating the author likely ported existing functionality into Golang.
Jan 8
Acronis
TMPN (Skuld) Stealer: The dark side of open source
Sep 8
Github Web
GitHub - hackirby/skuld: Next-Gen Stealer written in Go. Stealing from Discord, Chromium-Based & Firefox-Based Browsers, Crypto Wallets and more, from every user on every disk. (PoC. For educational purposes only) · GitHub
Sep 8
Github Web
