Discord attack detection and response.

1. Suspicious links and downloads

Detect

• Unexpected login, Nitro, job, crypto, or “test my game” requests.
• Punycode lookalikes, shortened links, HTTP-only destinations, embedded credentials, or executable/archive downloads.
• A sender pressuring members to disable browser, antivirus, or Discord warnings.

Respond

1. Do not open the target. Copy the Discord message link and take a screenshot.
2. Run /url-check; remember that a clean DNS result is not proof of safety.
3. Use /report-security privately. Staff should remove confirmed malicious content and warn the sender without reposting the URL.
4. If opened, disconnect only if active compromise is suspected; preserve logs, rotate exposed credentials from a known-clean device, revoke sessions, scan, and notify staff.

2. Account takeover and token theft

Detect

• New login alerts, unexpected authorized apps, disabled MFA, changed email, or unusual direct messages.
• Messages sent while the member says they are offline, especially repeated links.

Mitigate

1. Reset the Discord password from a known-clean device; this invalidates the token.
2. Enable authenticator-based MFA and store recovery codes offline.
3. Review Devices, Authorized Apps, Connections, and browser extensions.
4. Staff temporarily restrict the account only when evidence supports it, document the reason, and provide a review path.

3. Invite spam, mass DMs, and raids

Detect

• Repeated invites across channels, rapid unsolicited DMs, synchronized joins, or mention bursts.
• New accounts that immediately request payments, credentials, downloads, or off-platform contact.

Mitigate

1. Use Discord raid protection, verification, mention-spam controls, and the invite AutoMod rule.
2. Members report suspicious DMs with screenshots; bots cannot inspect private member-to-member conversations.
3. Staff place evidence-backed cases in a restricted review queue, apply the least disruptive control, and time-box restrictions.
4. Afterward, review audit logs, revoke compromised webhooks/bots, rotate exposed secrets, and publish a factual update.

4. Malicious bots, webhooks, and permissions

Detect

• Unexpected webhook creation, role changes, channel deletion, bot additions, or permission elevation.
• Non-staff roles with Administrator, Manage Server, Manage Roles, Manage Channels, or Manage Webhooks.

Mitigate

1. Run /security-audit and review the private staff report.
2. Remove unnecessary high-impact permissions and keep bot permissions scoped.
3. Use separate human and integration roles; disable unused integrations before deleting evidence.
4. Export audit-log timestamps and document every remediation.

5. Recovery checklist

[ ] preserve message links, screenshots, and audit timestamps
[ ] identify affected accounts, roles, channels, bots, and webhooks
[ ] contain with the least disruptive temporary control
[ ] revoke sessions and rotate exposed credentials/secrets
[ ] remove confirmed malicious content without reposting it
[ ] validate recovery and monitor for recurrence
[ ] publish a factual member update; avoid unsupported attribution
[ ] record lessons learned and update controls