Discord's Dyno Verification Bookmark Scam!

Do you need to drag a bookmark into Discord to verify on a Discord server? Chances are you are about to fall for a scam that will take your Discord Token! This scam impersonates Dyno (but can also impersonate Mee6 and other popular Discord bots) and asks you to visit a website to complete verification. This is not like the old Discord QR code verify scams. It's a bit worse.
SOCIALS
-----------------------------------------------------------------------------
Discord Server
/ discord
TIMESTAMPS
-----------------------------------------------------------------------------
00:00 - How the scam looks
01:52 - How the scam works
03:59 - What is a Discord Token
05:05 - What to do if you fell for this sam
05:28 - Please let the homies know about this
05:56 - Bye bye luv u

[@NoTextToSpeech]

IF YOU GOT SCAMMED BY THIS, PLEASE READ ME :) 1. Before changing your password, delete the scam bookmark. 2. Then once you do that, change your password.

[@mineblox667]

Best one.

[@Iceice69420]

@@elderlean7876 Changing password means changing the account token code

[@infinyer2323]

3. Remember 1 and 2.

[@VeryCuul]

Change your password first.

[@ufmatt001]

Use a js decompiler

[@maxmoors]

I'm honestly surprised that people are managing to do this. Most people that try to verify in a server can't even follow instructions to verify by clicking an emoji or copy paste a certain command

[@funl]

i swear everyone in the server could change their name to READ PINS and you would still get people who dont know what to do

[@sigilkoree]

Welcome to Discord

[@itsTyrion]

ikr? On my MC server, people kept struggling with the verification/discord linking. it literally says in-game "click *here* to get your code" (here being red and underlined), it's written into your chat to copy paste into Discord. nope, too difficult. some people are dumb.

[@1ce_0loger]

@@itsTyrion frrr

[@creeper_triste]

YES

[@Sung.Jin-WooAmv]

Discord has become such a mess with those scam issues man..

[@thundurr]

Literally every single large platform has, KZbin, Twitter and Instagram all have so many scams. On KZbin i think it's the worst

[@stars227]

Because their employees are entirely incompetent. Discord support is almost non existant, and when you do get a reply it's some half assed copy pasted crap.

[@Lephiz]

@@stars227 then be on alert and don't click on random links.. discord can't do anything if you are the dumb person

[@Ethorbit]

@@stars227 Yep, exactly. And the only features they work on are the ones people aren't asking for. I had full access to my account, but needed them to change my email address because it was no longer accessible, and they told me to create a new Discord account. Their support is useless.

[@k4rimaa]

I dont know what discord employees you guys are emailing, but back when i got hacked they replied back in two days and disabled the 2-factor authentication the hacker set up on both of my accounts (yes i got hacked on 2 accounts. Im a bit stupid)

[@Ketsui.]

Lmao the "wrong tab" was some outta nowhere humor I wasn't expecting

[@darklviper3179]

Its hilarious when you realize how far people go just to get your information

[@groove7854]

This is just basic phising wym

[@darklviper3179]

@@groove7854 maybe basic for you , not for people who don't know what the bookmark can do with them especially for older people or kids

[@somedudeonyoutubefrfr]

@@darklviper3179 Still basic, wdym... If people fall for it, then they maybe should stop using the internet...

[@saai4life]

anyone remember that time where bots would DM people invite links to 'weird' servers? I found it really creepy when it happened to me.

[@MusculosoDigital]

same, one day it even sent me a jumpscare with a scam link

[@JilanAHmed]

happens daily

[@Furetto126]

@@retroaspectgaming you don't really need to be a programmer to know how to change passwords lol

[@nanacue]

had one, it was a weird server and jumpscared me and hacked my server, stole my token and lost my 1 year nitro

[@ras.51]

@@retroaspectgaming coder? thats not the correct word

[@KudaXD]

That "Wrong tab" part killed me bro 🤣

[@WolvericCatkin]

Also of note: _Reauthorise YAGPDB if you have it..._ it doesn't actually make use of the *Join Servers for you* permission, and it's been removed from its default scope for a while now... 😅

[@parknich081]

thanak you, underrated cfomment

[@sigilkoree]

thvenj yuo so muhc

[@Krakyy]

thksnkd you smchu br sti oggmegltgu

[@vedamaharaj]

bro if it doesn’t actually use the scope where the issue?

[@Krakyy]

@@vedamaharaj hmm thats weird thism an caln spell

[@ShiloBuff]

HAHA love your "wrong tab". Thanks for the laugh. Also thanks for making people aware of scams.

[@ShiloBuff]

@DDD9216A HAHA! I didn't notice because I skimmed the video. Now I see it. Have a good day!

[@Zooiest]

I deobfed and reverse-engineered the script, and here's what I found: - The JSFuck portion of the code evaluates to "fortniteamongustycoonlol" (from a base-64 decode.) - The RE protection is more clever than one might think; the globals array is mutated until a specific alignment is reached. - The script registers its own module into Discord to access other modules. - The script can detect said module if the code has already been run. - jesus fuck it was annoying to reverse-engineer

[@danialrafid]

very interesting, thanks Patrik Käpyaho

[@ulysses847]

thanks Patrik Käpyaho for this information

[@mlgdoge12343]

Fortnite among us tycoon

[@firstsurname8931]

what is "Re protection"

[@Zooiest]

@@firstsurname8931 protection against (r)everse (e)ngineering

[@BuuyaXDev]

can you teach us how to talk to girls though, its gonna be your biggest video yet

[@Nullifys]

I gotta send this to my friends, thanks for letting this be known!

[@Patrik2166]

Thank you! Shared it already with my members :D

[@real1cytv]

They really used JSFuck to obfuscate the code xD

[@SheepieAnimations]

thank you for covering this, its been happening to me, i turn on my phone and im in a rando server ive never heard of, but i didnt do the bookmark thing, but thanks to you, i fixed it

[@jumanshandillya]

This guy is the best on 2022 who make legit make sense and good discord video keep the good work, best wishes.

[@mr.slappii513]

So basically. A basic feature on most browser rats them out? That's kinda cool. Imagine being a hacker/scammer and you got ratted out by a simple function like hovering over a bookmark.

[@Furby.1987]

still knew about this method and did a warning on our discord about it but thx a lot for that video :) u explained it rly good

[@Fryte]

4:35 yes it is possible actually, honestly it's very likely to happen considering fact you won't even realize what thing added you to some weird server BUT that's very much all they can do by authorizing you to their app (again, only by authorizing you, of course they can do everything when they have your token)

[@iangreen180]

I didn't go through with it, but I searched for the suspiciously dangerous "verification" method from the supposed MEE6 bot and found it described here on your video. Thanks. When Discord server admins have their Discord token stolen it's "hell to pay" in their community as admins get kicked from their own server!

[@generalidea2897]

Sometimes secrets are kept by projects on Discord in "private" channels, that can be exposed if an admin has their Discord token "hacked"!

[@MeMakeMemes]

This man giving more discord scams fact every day just to keep is safe

[@mc-mc2645]

I think they WOULD want your account. Seems like you have so very valuable information on how to get a girlfriend. Those scammers will need it to actually get a girlfriend.

[@BenCos2018]

LOL one of the best comments I've seen

[@boigd7995]

“What to do if you fell for this Sam” lol😂

[@johnthemannn]

Another thing you should do if you get hacked is to check your Devices settings menu and delete everything.

[@light3466]

That "How to get a girlfriend" tab got me hard 😭

[@mer6266]

I thought dyno is a very safe bot so i press into the link and do everything it ask. Thanks for posting this video to let me know that its a scam. I've always wondering why there is new server when I turn on my laptop.

[@mythic_rblx776]

I remember watching you 2 years ago, then i didn't see you for like 1 year, das crazy

[@That_0ne_Dev]

Discord seriously need to up their security and scrap account tokens altogether

[@kellymountain]

tokens are kinda the only good option though, sure you could store an encrypted email and password but there's not much of a difference

[@ZeldagigafanMatthew]

I think the tokens are fine, but only if they are wholly unique per device. If the same token shows up on two devices, the system should immediately deauthorize it.

[@mallusrgreat]

@@ZeldagigafanMatthew NO. I use Discord on multiple devices and it would be a huge problem for me to log in everytime.

[@chocolateimage]

I think tokens are like session id's, It needs tokens because else it doesn't know what user you are currently logged in.

[@evangaming7447]

@@mallusrgreat thats not what they mean its per device so each device has a different token and if one is stolen off one device you would then have to relog in because the token was stolen on that device.

[@void6670]

I remember this from "how to get your discord token in mobile" is basically the same bookmark scam

[@maciejkag2735]

bro, im actually impressed by people making these scams, like they are using such crazy but simple methods to scam you really legitimately.

[@marketo_9253]

2:03 holy shit I didn't expect that! XDD you're a genius :'))

[@iamv1ce]

i love how i had the tf2 scaredy-cat taunt under this lmao it looks like it was reacting to this

[@LerpCat]

“How to get a girlfriend” made me laugh so hard

[@Neuzie]

“how to get a girlfriend” “wrong- wrong tab”

[@RobloxNerd_YT]

💀

[@Dolphin002]

I remember this exact same scam was being used on another site, crazy how it's spreading

[@tommuinnit]

I tried to get here early but can you talk about the inviter bot that dms you some nitro gift thing, it’s happened to a bunch of my friends and stuff and we don’t really get what’s happening with it. Ty no toes to show :)

[@hamizannaruto]

Its a phishing link, that bring you into a fake discord website and convince you to sign in, which send your password and email to the scammer. This one is pretty dangerous as they have your email and password, meaning that your discord account is completely compromised, unlike token where the scammer cant do anything except very little, like sending message, joining server The bot are usually fake bots. The scammer joins big server and start randomly sending people DM. Then they look the compromised account friend list, and send those people DM, and the chain keep going and going until none are left.

[@LocalTrashyt]

those x blocks are characters like "f" or any unicode character, but its a link that a computer use to get a character from it's memory instead of displaying. Mostly used for unicode characters that aren't on a keyboard.

[@johnsonsaji6557]

Even though it is for bad use, this method of gaining your Discord Token is actually impressive - can't believe this could exist.

[@kgiotakos]

The kiss in the end hit different

[@helper_bot]

i would have never for the life of me thought you can run js code just in your bookmark, lmao! imo every web browser need to either run a check on the js script before putting it into the bookmark, or just straight up disable the feature. these scams man, they're getting quite wack

[@koishikomeji6969]

not the "How to get a girlfriend" tab lol

[@mr.dim22]

Thank you for the warning😎

[@yodaluca23]

yea using bookmarklets to inject JS into the console is a pretty smart tactic for people who are not tech-inclined...

[@blllk8189]

As soon as it said to bookmark the code I knew what was going to happen

[@Boypogikami132]

This is exactly why I like Notepad++. And I really appreciate that my Computer teacher made us download it.

[@tbuk8350]

This scam exploits the fact that if you put "javascript: (code here)" into a URL bar in a browser, it executes the code on the current website. You can try it here on KZbin, actually! Try copying: "javascript: alert('Hello, World')" into your browser bar (without the double quotes). It'll create an alert popup. Now, where am I going with this? A bookmark is basically just a hyperlink embedded in a bar in your browser. If you click on the bookmark, it'll bring you to whatever page you bookmarked, just like a link. The catch is, that also means if you put JavaScript in a bookmark, it does the equivalent of putting the JavaScript in your URL bar (There are intentional versions of this, called bookmarklets. They can be useful, though they aren't malicious, they're basically just advanced JavaScript macros). Additionally, the JavaScript in the URL bar can access all of your local client data, due to JavaScript giving any other script running on the page access to the scope. So, how do you protect against this? There are two main options: 1. Don't add/open any bookmarks you didn't create yourself, or you haven't checked over to make sure it's safe. As I've said, not all JavaScript bookmarks are bad, but they often can be, so be cautious and check bookmarks you didn't create. 2. Don't use a Chromium browser. I'm not sure I know of any Chromium-based browsers that aren't vulnerable to this, as they all support running JavaScript in the URL bar for some reason (You shouldn't use Google Chrome anyways (has Google trackers embedded in the browser, terrible performance) or Opera (purchased by a chinese consortium and contains injected spyware), Edge is fine for now). I highly recommend using Firefox as your primary browser, no matter what, as it's more performant that Chromium, blocks these sorts of attacks, prevents trackers from following you on the web, and doesn't track you itself. You'll be much safer on the web using it. Edit: Oh yeah, forgot to mention, these attacks can also be injected in hyperlinks or buttons. This is why sites typically don't let you manually create them, and if they do, they filter them. You can set a button's "onclick=" to JavaScript, just like how you would in a browser bar, and you can set a hyperlink's source to JavaScript, and it will do the same. If sites let you create hyperlinks manually, you could quite literally steal people's usernames and passwords with nothing more than a hyperlink.

[@sc4ndal]

the "How to get a Girlfriend" killed me 💀 also i just noticed the notepad++ tab 💀

[@goxlr]

you know the scariest thing is that my discord crashed right as i was watching this video

[@Migixkem]

I kinda already quit discord and don't use it that much anymore but I really like your content

[@Svn_]

how much you wanna bet NTTS cleared all the sussy bookmarks for this video

[@Notdaowl]

“The first step to getting a girlfriend is stop trying” ☠️☠️☠️☠️☠️☠️☠️

[@L0V3V4MP1R3]

Running JS through bookmarks is such a novel idea holy fuck

[@_purple_44_]

Being a verified bot developer i know for fact that bots cant send messages or make you join servers! Dont click on sussy links (make sure the dashboard links do belong to the bot , the domain of the url should be accessible by some command) Thats it.

[@Tiguex]

Bro got me sending every link i see to my FBI agent for him to see if its good or not

[@thiagopenteado886]

They are using as Mee6 now too... running a different code not sure what is does, but it runs as a "javascript:fetch(atob... "

[@GamingWithBenji]

How do you get those beautiful folders?

[@b-eleven]

Damn, these scams are getting so obvious i can't even make a legit Wick verification system because people are leaving because they think it's a scam on first sight, now Dyno too?

[@trejkaz]

Rule of thumb, any verification that goes out to another site is a scam until proven otherwise.

[@MrKneeBeeYT]

the fact that people actually believe a BOOKMARK is a legit way to verify.

[@slingamer2289]

I like ur first tab in the browser😂

[@brendanpls]

They grab ur discord account for a certain server your in, they dont give a shit for ur account once you post a singular msg in a server ur in.

[@overlisted]

Of course a technology as old as bookmarklets can only now be used in malware...

[@ninethetwotailedfox]

We're all talking about that, but what's more dangerous is trying to find a girlfriend on google.

[@asfdirt]

oooh, this is a new type of scam, they always find ways to get people into scams. How creative are these people

[@sfisher923]

I somehow learned something new I didn't know you could book Javascript Code

[@Theo_1390]

I love how nobody in the comments section mentioned the fact that he searched up "how to get a girlfriend"

[@Achromatic_0]

i saw something similar to this but when you click on a button below the message a qr code pops up and it wants you to scan it. knew it was fishy from the beginning. no idea how it got a hold of a pre-existing server and messed it up like that though

[@samover6603]

time for some trolling (spamming the api)

[@aldyreal]

We do a little trolling, that jsfuck is nothing lmao

[@kosmaaaa]

Is it just me laughing at the fact that he has a tab opened in the browser called “how to get a girlfriend”?

[@Lsunix456]

That tab bro💀💀💀

[@7heMech]

I showed the joke to my bro, and then I remembered he has a gf now...

[@NexyDev]

The "how to get a girlfriend" tab lol

[@NotJaden.]

One of the sections has a mistype in it. It says ‘sam’ instead of ‘scam’

[@Bumble._.Jellybottom]

CRYSTAL AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

[@nolanmales]

I have one thing to say. Wth was that ending? I think that was kinds subs not gunna lie.

[@Scott170c]

These executable bookmarks are called bookmarklets. It can also have some helpful uses and can bypass your school admin 0-0

[@chri-k]

what do you mean by “bypass your school admin”

[@Scott170c]

@@chri-k normally my school wouldn't allow my chromebook to use the inspect element. By using a bookmarklet I could use it and return the output using an alert.

[@chri-k]

@@Scott170c why in the world did they block the developer tools

[@Artplanefish]

all the serious things aside "how to get a girlfriend"

[@yigitsalar]

scam website: to enable your bookmark bar press (CTRL+SHIFT+B) me enters this website on phone: how?

[@nohobowhat]

This guy is actually losing his mind lmao

[@deadcheessss]

I always get dms from bots that are offering me job offers. It’s so weird and annoying

[@PhilXavierSierraJones]

Oh, bookmarklet stuff. I thought this died back in 2017.

[@centycebra4447]

hey you were right about the authorization part the only thing is they can also add some weird things which basically access your ip and sell that stuff because that all can be accessed through the console too and other stuff. surely not written by an java coder.

[@dylon4906]

nobody is gonna sell your ip. it's not a 100% accurate indicator of location and it gets changed periodically by your isp. also your ip is given out to literally every single website you visit so it's not hard to get either

[@v01d_r34l1ty]

@@dylon4906 That is not entirely 100% true. Your IP is basically your web address and it doesn't always change. For example, I'm still living with my parents right now, and they don't pay for a static public IP address, yet the public IP address hasn't changed in years. Not to mention that the only time it did change was with a new router on a new package with a whole new configuration. Unless your ISP is different, IPs are still a great resource to track people across websites and harvest data for purposes such as advertising and identity building. Your IP is not always geographically accurate, but it's also generally pretty easy to decipher what ISP is providing your service, and with a little social-engineering or backdoor services, you can find out exactly where somebody lives. It's less common nowadays, but this was a bigger problem 10 years ago.

[@Zaary]

java is not javascript? XDDDDDDDDDDDDDDDDDDDDDDDDD

[@Guardie]

So what you're saying is that if we see one of those in the wild we just copy the link from the script and spam their API with a bunch of random bullcrap? Gotcha!

[@waltuhwhiteburgerkingdrake]

Why did I laugh at the "how to get a girlfriend" tab

[@ceecide]

why does chrome have the feature to run javascript from a bookmark? seems dangerous to tech-illterate people, does it have any actual use cases?

[@Zooiest]

It does! I have a few bookmarklets for things like special static URLs (such as Wikipedia's /wiki/Special:Random), utility functions (such as evaluating code quickly/on mobile, bypassing some adblockers, or loading an external script), etc.

[@lifinale]

not only chrome, any browser can run Javascript from a bookmark. Mozilla has a whole guide on how to use them. It’s a unique way to replicate extensions without having to publish your extension to the web

[@pjok]

If people are dumb enough to let this happen to them in 2022, they deserve having their account compromised.

[@JohnSmith-oq7bg]

Someone commisioned me to make this for them. The code was fairly simple to make, and it was really easy to understand and learn.

[@object.toString]

Do you still have the source code?

[@JohnSmith-oq7bg]

@@object.toString I do yes

[@obinonso978]

@@JohnSmith-oq7bg please can you make it available?

[@Mempler]

kde background on windows is just cursed ngl

[@breberton]

Discord needs to fix these scam issues one way or another. If they don't do it soon I don't see it going well for Discord in the future. or alternatively, people can just use their brains :P

[@Grenja]

And move to Guilded, probably

[@taureon_]

@@Grenja "move to guilded" isnt a problem solver as they could just make it work on both apps

[@amongsussyballs]

guess we are all moving to matrix then

[@somedudeonyoutubefrfr]

@@amongsussyballs We are already in one, we don't need another /s

[@darkbeat1165]

“wrong tab” 💀

[@BowDown097]

It's incredibly stupid that JavaScript bookmarks are still a thing. They're pretty much completely obsoleted by extensions and pose a huge security risk.

[@czebosak]

@@kxi remove them entirely

[@czebosak]

I didn't even know that they existed

[@filo1819]

@@kxi ​ not discord, your internet browser

[@pfqniet]

I use JavaScript bookmarks for automation tasks, but then again I'm a nerd who uses JavaScript for automation... Just like every tool, they have a use, and just like sledgehammers they can be misused to devastating effect.

[@ilmansalt]

I use them, but browsers should really have an option to disable or enable JavaScript bookmarklets, and it should be disabled by default.

[@Arvl.]

This is starting to get out of hand

[@donnelleraeburn9207]

the scammer also has access to your location

[@igntiktok1105]

The thing is: one of my friends can code and made an exploit for this bookmark thing, it can do many more harmful things than just getting your token

[@mr.incognitoyt2235]

Damn, bro. Guess they gotta watch out

[@f_e48]

ty bro u life saver

[@glitchy_candy]

Ok ig I’m lucky that I never seen this scam. But thanks for the heads up.

[@FascistTrex]

I had no clue that bookmarks Js was a thing. I don't see any legitimate usage for this function

[@nitsua1103]

I'm willing to bet the people disliking this video are the same people that are stealing account tokens 💀

[@sharkbait_gaming]

2:27 ayo "how to get a girlfriend" in his tabs?

[@very_smort]

is anyone gonna talk about his "wrong tab"

[@shwetakejriwal9380]

I love how this guy has easter eggs! the notepad said a tutorial for talking to girls the search bar has how to get a girlfriend lovely!

[@Raka_]

wow

[@thewizardbrand]

thank you for this