Discord phishing by social engineering the moderators

Recently a couple of instances of phishing have come up in a Discord server I moderate that I find worth documenting. The attacker joins the server and reports a user for sending phishing links via DMs, then uses a second account to impersonate a moderator in order to get them to hand over personal information.

In all cases I’ve encountered so far this is related to the theft of Roblox accounts. I’m not a security researcher, please do your due diligence as a moderator in all cases.

Step 1: Attacker joins server and asks for a moderator

In both instances that I’ve seen this happen, the user joins the server and immediately reaches out to mods.

Step 2: Attacker claims to be sent phishing links by a victim

Here is an example of the messages they provide as evidence against the reported user.

Step 3: Attacker impersonates mod team after kick/ban

This is where the actual phishing attempt happens. After the moderators of the server kick or ban the user, an impersonating account reaches out to the victim claiming to be a moderator of the server. They show the user the same images that were provided to the mod team with a video.

They then request a call where the user shares their screen to “confirm nothing is edited”. At least one user who actually agreed to take the call told me they were then asked to show a video of their Roblox game screen (I assume to give them sensitive information).

In conclusion you should be incredibly wary of users who join your Discord server and immediately claim to be sent phishing links by other users. It’s really unfortunate how bad the bot and phishing on Discord has gotten lately.