Investigating Discord's Fake Verify QR Code SCAM!

[@interludes4]

Fun Fact: They don't actually get banned, they use an alt and give ownership to the server, because when discord removes a server, it permanently bans the one who owns it from discord.

[@txrmsconditions]

i mean they can create another account, and create another server lol

[@b4ndoshysty]

@@Bismarck-1 vpns exists tho

[@Minty.]

@@b4ndoshysty vpns sometimea dont work

[@jerrell1169]

@@Minty. VPNs work almost all of the time. Short of Discord downloading it’s own malware onto your computer to monitor your devices you can easily evade a ban.

[@dat_randomguy_]

@@Bismarck-1 they can just hotspot from their phone and discord cant ban the hotspot IP because it is used by thousands of different ppl bc its mobile data

[@vexirale]

i love that there’s minecraft music in the background

[@naxyan1193]

Lmao

[@rezmoon]

man talks about serious scam where people can get person info and sensitive info, (casually puts minecraft music in the background)

[@naxyan1193]

@@rezmoon yez

[@hypnotik1577]

Minecraft easily has the best music

[@CricketChris513]

i started thinking of that and then like literally not kidding, not, exaggerated 1.3 seconds later i looked down and saw this comment

[@toasty3205]

Props to you for bringing awareness to this scam, I almost fell victim to this!

[@sophiatheczech1918]

Good that it was just almost, and not completely.

[@yeetmeme2421]

how bro

[@SageVoyager123]

i fell for it but dont have any personal details on there so i changed my password

[@SuperBoop]

My friend fell for it

[@SuperBoop]

@@yeetmeme2421 idk man, it usually should be pretty easy to avoid these things

[@immortalaxolotl]

They already "scan" images for being inappropriate, so I wonder how hard it would be to add a QR reader to that and if it's a 2FA link then uh oh, block that shit.

[@ThatProgrammer]

Honestly, this would be a nice feature the could add. They've proven it's possible with AutoMod, so why not add some code that scans messages sent and see if the QR Code results in a discord login token, then block it, at the minium. No one on discord should be sending QR Codes in chats that are associated with logging into discord. On top of this, another fix would be to add a timer on how long the QR Code lasts after being generated and only allowing the same IP Address that created the QR Code to scan the QR Code, although this could be problematic for people who aren't on the same network.

[@immortalaxolotl]

@@ThatProgrammer Same network restriction would be problematic because if someone is on data and they scan the QR code, that's not gonna work.

[@SimWasTaken]

I actually thought of something like this trying to find ways to combat phishing, alongside this I'd say a good solution is detecting where the new log-in location is from and having you verify with your phone that it's you, if it detects a QR code and scans it, then the message receiver gets a new log-in attempt from let's say Russia, but they're from the US, the log-in attempt is paused until you accept the log-in request through your phone with 2FA Discord already has your location and scans every message for malicious content, so I don't see why they wouldn't do this to help fight an ever-growing problem in their platform, it would take just 2 more minutes since you already have your phone in hand

[@genericallynamed1]

This is certainly a pretty dangerous scam since scanning QR codes is pretty trivial for phone cameras now, and I'd imagine in some cases a phone's camera app might just automatically open links as soon as they detect one. There will always be other scams but in this case if Discord could just auto-scan a QR code and check if it's a 2FA code, then the scam would pretty much be dead, since if Discord's QR-checker system can't detect the code, neither would a real user's phone camera.

[@minecraftminertime]

It seems like Discord already has a confirmation screen for the QR code. It says are you trying to log in.

[@remcobosma9646]

If this has happened to you. Reset your password ASAP! They get your discord token and they can login to your account. When you reset your password the token will reset as well and the hackers can’t login anymore. Discord has said this them selves. I hope this helps y’all.

[@Snoop_D0gg]

It just happened to me, it sent the server link to everyone in private messages, but I deleted every link again by hand and changed password.

[@Markezz7]

@@Snoop_D0gg me too bro it was so embarrassing

[@cancerplays612]

hi bro what happen when you scan the qr using google lens?

[@ratsarehot0]

thank you 😭

[@nicksartandgaming1151]

Help what do I do this has happed to me and I cant get into my disord I dont get the 6 digits pls help im begging been like 3 hours now

[@solareclipse1201]

Even if discord stops this scam people will eventually come up with new scam ideas Which is why I agree that there should be a penalty for malicious behavior

[@lazyfrog1718]

you think they just don't do anything about it? lmaoaoaoa

[@AmaanPlayZ]

@@lazyfrog1718 I think the man means suing. People stealing information on discord that have no life’s should be sued. Pretty scary for those scumbags so it’ll work better than just a warning and a ban lmao

[@lazyfrog1718]

@@AmaanPlayZ how are they going to obtain the legal info to sue?

[@barneyassman]

@@lazyfrog1718 stealing money (Using their money to buy nitro, etc.), stealing up addresses, etc.

[@lazyfrog1718]

@@barneyassman no, how will discord get enough information on the person to sue them?

[@stayednateman1718]

I fell victim to this scam, but I got my account back before they changed the email to it or anything so I would lose it completely. Thank God my nitro was paid for by a empty prepaid visa card. Only thing bad that happened that I was sad about is that people I friended but didn't have a mutual server with could have fell victim to the scam and I would have never known.

[@_patriik]

There should be no way to change your email because discord sends you a confirmation email to your email address to confirm that it's you wanting to change the email.

[@Thefootqueen]

Same. As soon as I realized what happened I almost immediately changed my password. Luckily I didn’t have any credit card or personal info there besides my email and phone number.

[@Dididou-sn9rf]

@@Thefootqueen just add this problem too few hours ago. I deleted the bot in settings I think problem is resolve just all my friend receive the link lol.

[@ludaalt3147]

I fell victim to this scam too, ive only changed my password and add F2A authentication, am I still fucked or is there anything else I have to do?

[@Dididou-sn9rf]

@@ludaalt3147 well i think u don't have to do more things. Nothing change, no more problem for me so i suppose the bot only sent one time and not spamming

[@SuchtiAT]

I love how the QR code on the thumbnail brings you to this video. You missed a perfect chance for a rickroll

[@the_synack]

Discord needs to retire the QR code feature. I think it's causing more damage than it is helpful.

[@moyaiibruh8109]

True. And I don’t even use QR Code at all whatsoever

[@RynoWasTaken]

Not really someone like me is just lazy and use it, it's a useful feature but unfortunately it got abused

[@itsyaboivoid]

i use it so i hope they dont

[@itsyaboivoid]

@@hi-kt3qr i use it

[@possiblymatt7970]

@@hi-kt3qr i use it because i keep forgetting my main account's password in pc but my phone is logged in so yea

[@ToastyStuff]

Online scamming should be against the law and it should result in active punishment irl. Scammers are just too confident that they won't get any consequences from their actions.

[@xfighters3913]

Your right because there are zero consequences and Discords team is dogshit.

[@GammaFZ]

it does, but as you said, they get away with it

[@nicksartandgaming1151]

Help what do I do this has happed to me and I cant get into my disord I dont get the 6 digits pls help im begging

[@hi-kt3qr]

thats hard to enforce because the US isnt the only country on earth

[@ryanwagner3890]

As hi already pointed out, the issue with that is that international law is tricky, so passing a law in america to deal with scammers won't do much to help with all of the people scamming out of third world countries that don't tend to bother with those types of laws, and it's also a bit too small of a thing to even bother trying to get put into international law, even if that was regularly enforced.

[@importprogram]

Honestly the best solution Discord could do, even though I really don't want the images to be scanned (although its probably already happening...), is for Discord's Image API to find QR codes within images and cross verify them with their authentication system to prevent it. The QR code login feature is fantastic but since its been introduced its been used for so many scams. Although it may take a year(s) for them to actually implement it but thanks for bringing attention to it!

[@florisbroek]

They can better Make the qr code refresh every few seconds and add a small extra code under it to make it dubbed verify. So they can’t steal anymore

[@shelletonianhuman]

Bots could have a legitimate use for QR codes, BUT! Discord should detect Discord's login QR codes, not ban every QR code.

[@neey3832]

they can read the Qr code and see if it redirects to a discord auth url, and then block the image. it's really simple to solve...

[@JasonHorkles]

They do already scan images for explicit content, of which you can block in your settings

[@kellymountain]

@@JasonHorkles true but the filter is horrible and has false positives all the damn time

[@xdveronz]

I had one of my fav youtubers on my DM's months ago cuz like I wanna say "I'm your biggest fan!" like that, and however weeks later she messaged me the same message "Idk if it's you or..". I'm glad people are spreading awareness of this new scam method :)

[@sfisher923]

Something similar happened to one of mine but it was a "Free Nitro" Scam on their server (It was like 4am when that happened so I was sleeping)

[@jorisbeugen3562]

This morning a friend sent an invite to a server with the message: check what happened in #general, i cant believe it!. So i joined the server because i was curious but i saw i needed to verify. Luckily i was on discord mobile so i couldnt scan the QR code with my phone because i already was on my phone and i was too lazy to open discord on my laptop. First time that being lazy actually helped for me

[@ruinsfnbr776]

my content is beter

[@niko5008]

@@ruinsfnbr776 cope

[@vexirale]

@@ruinsfnbr776 the only thing you posted is a fortnite XP glitch. Stop trying to advertise your channel

[@TheOriginalSide1]

@@ruinsfnbr776 bro you cant even spell better right

[@sophiatheczech1918]

And this is why I don't hate the fact that I'm the laziest girl out there.

[@lukewarm5978]

the fact the qr code in the thumbnail isn't a rickroll is a missed opportunity

[@Fybinex]

and it isnt in the video. This made me sad

[@Fybinex]

the qr code in the video*

[@devuxious]

after seeing this, i'm developing my own bot which sends you to a rickroll. thanks for the idea!

[@Fybinex]

@@devuxious you genius

[@_username]

@@devuxious ultimate scam bot

[@rigidteeth]

his voice is so chill

[@patchon25]

"Good" hackers usually publish stuff like this to put some pressure on companies to actually fix the issue, this QR code scam has been known for years and yet here we are.

[@BILBRB]

Imagine if this dude is behind the scam the entire time and he’s making these videos to cover it up lmao. This prolly isn’t right but imagine

[@Eye777-g4i]

Could be because. He knows

[@AGuyThatExistes]

i love how this guy explains us how to limitless scamm people and also showing us how to avoid getting scammed

[@blank7279]

"If you use this, you are a peace of garbage" a little later, he literally shows the whole process

[@9k011]

Just got one today, scared me, saw a qr code, instantly knew something was off. Thank fuck I didn't scan it. Instantly searched up discord qr code scam and you came up! Thank you :)

[@TwinShards]

0:45 "This QR code doesn't work so no need to blur" SMILLY FACE :) I was hopping to scan it and get Rick Roll. 😒

[@thewizardbrand]

You definitely earned a sub, you teached and showed me things of the most important which no other youtuber would ever do

[@zanesnep]

I'm so glad nothing happened to me when I fell for this, guess I was just really fast in changing my password and removing my billing info

[@karlito1501]

They got your billing info if you got token logged before removing it

[@Isari301]

My accounted was removed 2 days later :(

[@zifor5395]

@@karlito1501 if I change the password and email very quickly after scanning the code, will that prevent them from accessing my account?

[@karlito1501]

@@zifor5395 they use a script so probably not

[@orlogskapten5617]

I recently got a weird message from a friend inviting me to a server, upon doing so, I was asked to verify with a QR code, got a weird feeling, googled it, and found this video, I checked the logs of that said friend on mutual servers and saw that multiple people fell for it and got their account stolen, sad to see, glad you made this video, saved me from losing a loaded account

[@foundfpvfootage]

A update on the repo: The owner took it down, since they didn't want to cause any harm with it. Their words taken from the announcement channel: I recently learned that my project 'Fake-Verification-Bot' was used by many people in a malicious way to scam other people and I'm sorry for that. It is important to know that my work was never created to be used in this way but mainly to show people what it was possible to do just by using the API made available by discord. Since a KZbinr (with about 80k subscribers) recently made a video about this to warn people, I'm afraid that on the contrary, it will make this project much more known and therefore more used in a malicious way which would be a disaster. So I'm thinking about deleting this directory to avoid more damage or make it private.

[@bah-fv2ec]

they are a freelance dev. they probably got commissioned to do this

[@Ribs351]

At least he had the decency to take the repository down.

[@matthew78917]

Lmao already cloned it. For personal use 😇

[@poldron7033]

@@matthew78917 give me it uwu

[@hi-kt3qr]

@@Ribs351 anti open source losers everything you have downloaded that is propriety is probably spyware by definition

[@benaubrey2410]

Couldn't discord just have a bot scan every image to see if it contains a login QR code? They already scan for pornographic content which im guessing is a lot more resource intensive than just checking a QR code.

[@defme]

@Sir Avian For example, the REAL Wick uses google authenticator WITH A QR CODE.

[@hi-kt3qr]

thats spyware you would feel safe having everything you send scanned?

[@benaubrey2410]

@@hi-kt3qr They already scan everything, including messages. Its used for advertising. Spyware is software that specifically spies on you after infecting a device you own, not data being collected from users by a company hosting the service. If you really want total privacy when using discord you're out of luck im afraid. So yeah, they should do it with QR codes.

[@benaubrey2410]

@Sir Avian I mean you already need to contact discord and give them your photo ID if you want to do certain things with a bot, im sure it would be no big deal having to do it to post blacklisted QR codes. And yes it would be super easy, I could make a script that would do something similar in 30 minutes. Having it be able to check a ton of QR codes at once is another story but they already check for NSFW images which is some black magic fuckery lmao.

[@triparadox.c]

They should've invested in this instead of the whole porn filtering. The filter barely works at all. I am sending totally wholesome pictures, and it's flagged as porn because the skin color or what not. It's completely dumb. I have to cut the image in half, and hope that it goes thru (50% of the times it does)

[@bbernyy64]

3:53 As a bot programmer, I am not completely sold on the fact that the creator made this with malicious purposes. I enjoy making 'fake viruses' or 'fake virus bots' with any intention of harm, just to experiment with what I can do. I think the creator of the program might've thought the same, and really didn't mean to do any harm, or use the program himself. Edit: he actually confirmed this and deleted the repo, mentioned this video in his apology

[@franny6221]

why would they post the virus online though

[@bbernyy64]

@@franny6221 I post every single project online, even if they can be used maliciously, to build up a resume for potential future jobs. I do find it pretty suspicious that all of his projects have something to do with token logging, so he might use these projects himself. I don't know for sure...

[@crowjax8855]

Well the difference here is that you make "fake virusses" while this is actively used to scam people. This was NOT made for educational purposes, it was made to steal discord accounts maliciously, that "educational purposes" tag is so that github wont remove the repo. Look with your eyes, man.

[@franny6221]

@@bbernyy64 can't u make a private resume though? I'm genuinely asking because i have no idea about this, isn't there a better way to build a portfolio without endangering people's bank accounts?

[@bbernyy64]

@@franny6221 You can set it to private, but other companies / employers won't be able to see your work, which might decrease your chance at getting a job. If i noticed one of my projects was used in such a harmful way i would A. Private the repo or B. Create a backdoor and inform discord about these scams, and not leave it online. This guy might still very well be a scammer, but there is a small room for doubt.

[@shirfix]

Discord should fix this problem

[@rigidteeth]

y e s

[@unit5960]

how can they fix it their is nothin they can do

[@kawcio1516]

no shit

[@unit5960]

@RIARO so do you want them to not allow people to use custom bots..

[@truearif6820]

@@unit5960 literally just remove the qr code to login lmao ez solve

[@xflour]

Had no idea about this, stumbled upon this and accidentally avoided the scam. Joined the server thought it was legit (obviously I know now it wasn't). Good thing is, I don't have a secondary device to scan a QR on, and my phone is so broken when it comes to scanning QR codes it wouldn't have even worked. Nice to know that me not having advanced technology for anything helped me for once. Great video as well, very informative

[@monokoUwU]

Same

[@blank7467]

Seems like the heart of the issue is the lack of innovation and having such a basic sad sack of a method for keeping track of people's accounts such as a token system

[@god_2.0_the_better_version]

Discord should have a sort of test to help you better understand. I remember an update came to adopt me while I was monitoring my little sister on it, and it was a whole thing you had to go through to understand what kinds of scams there are and prove you know how to avoid them. Nothing annoying or too long, just something you have to go through in order to make an account. Personally, I'm very good at not falling for scams, but some people are not. A server owner everybody trusted was warning people about a scam, and pinged *everyone* with the link to the scam. Some people didn't see the part telling them not to click it, and multiple people lost their accounts, it took us a while to get some back but we didn't recover them all.

[@nicksartandgaming1151]

Help what do I do this has happed to me and I cant get into my disord I dont get the 6 digits pls help im begging

[@god_2.0_the_better_version]

@@nicksartandgaming1151 Dunno what you mean

[@yumuuai]

I have been scammed with a the discord fake games thing a long time ago not the qr codes but the name of the repo dev sounded familiar and the fact that they were in france made it even more familiar. Turns out when I got scammed I (tried to) decompiled the python exe file and through searching found a github repo. I continued talking with the guy who had sent me the Token grabber and got my way to find their phone number, rough location and their discord. I added them in friends and wasted their time by for maybe an hour or two. I got them banned from discord but heh they just made new accounts but im happy I pissed them off. And in their bio's they had a fake nitro website that I reported and it went down pretty quickly. Anyway great video and I definitely didn't expect to hear about the same idiots again

[@StealthGamers157]

I got that message few days ago, and I joined their server. I clicked the verify button and it gave me the QR code which was to scan it to get access to the server, and within 5 minutes i notice something off, some people's nickname was changed to "this server is scam you must leave", and I felt a bit nervous. I left the server and reported it to the discord!

[@RimFaxxe]

I got the message and cried because I lost contact with my best friend, they fell victim to it and deleted their amino account

[@StealthGamers157]

@@RimFaxxe So sorry for that

[@Sad_Crys]

Same it just happened to me 😭 now I have to find who else my acc sent the massage to so I can tell them it’s a scam

[@BeanzIthink]

a good way to tell if its a scam if you have better discord installed you can get show hidden channels to see if there are any that are locked chances are they dont exist

[@gtxg.]

Two things: 2FA doesn't prevent token logging whatsoever (some people think this) You can't just scan a QR code and get immediately token logged. A token logger runs on your computer, and if it was possible to scan a QR and a program run on your computer without any intervention from you, I'm very sure that the hackers could do way more. What normally happens is either the QR code is a login from phone, and even then, Discord has a warning to not scan QR codes you don't trust, or it redirects to a fake Discord login screen, and that is easy to catch out with the URL being different. Too many people think that if you click a link/scan a QR you get instantly hacked, which is completely untrue. Edit: Token logging works, regardless of if you have 2FA on your account.

[@MikeyTheA]

you are wrong the qr code is discords official login qr code and doesnt bring you to a fake login screen, it literally makes a new session and gives its token to the instance that generated the qr code, so yes they are simply token logging you by scanning the qr code.

[@Deltatron]

im a little lost on this, what do people scan the QR code? just any qr scanner or the discord QR scanner that is supposed to make it easier to sign in?

[@felixbemme7257]

This is an official discord login qr code. The scammer will just get automaticly logged into your discord Account

[@NotAViper]

If you scan a QR Code from discord. On your screen once you scan the QR Code you will get asked if this is you logging in. If the scammer clicks yes, they are logged in. I have tried logging in with a QR Code and I have 2FA It didn't ask me about a 2FA code. Unless they changed it, it doesn't ask for a 2FA code via a QR Code

[@yayer_27]

Your token is what represents you account on everything. Each message you send, you're sending a request to Discord's servers, and together with that, your token, which is what tells discord who you are. If they have your token, your username, password, email, 2FA, etc. doesn't matter.

[@harsh1784]

I just was going to scan qr code but I remembered that servers don't usually ask for human verification with qr code soo I search about this and got ur video Thx❤️

[@pleasantdashi7112]

No Text To Speech: “Why would anyone share a scam bot program if they’re not scamming people?” Also No Text To Speech: “Today I’m going to show you how to speed run making a scam server.”

[@noahvaught6588]

I almost fell for this. I joined the server, but I realized how fishy it was when it started asking me to send a QR Code. I didn't scan it.

[@bobross7993]

Me too

[@caliburxz9579]

So does that mean even if I joined the server but as long as you didn't scan anything , nothing will happen? Bcs for me I joined , but I left the server immediately , didn't scan the QR code at all, didn't even know there was one

[@eliteballer23]

i scanned it bruh help me

[@RynoWasTaken]

The best way to slow them down is to rate limit their bot which I think it's possible by spam clicking the button with multiple peoples and that will make their server rate limits their access to Discord's API unless they have good proxies they would get rate limit for too many requests and it restrictes the IP for at least some hours at hard limit -commited from Taiwan

[@ArbitraryDecisions]

Unless if they counteract it to not run the script again for the same person, which can be done with a line or two of code I believe

[@zagorxy8090]

yeah you go first 💀💀

[@RynoWasTaken]

@@zagorxy8090 I have tired it before the issus is they will ban you after too many presses so this requires multiple people spam clicking that button at the same time

[@bbernyy64]

Good idea!

[@hi-kt3qr]

No, thats not how it works. If you spam the button then you get rate limited not the bot.

[@markthistv9070]

after browsing through so many channels. Yours is by far the best. The explaining thod is so great and detailed even complex stuff is

[@bettercalldelta]

3:20 This was made exactly for what it is being used to, this disclaimer is here just so github doesn't ban the repo

[@fitmotheyap]

Yeah, I have seen youtubers literally upload videos on how to use these bots and all of them have "educational purposes"

[@fitmotheyap]

@ChannelForGamers search for server delete or ban all bots or somethin, it has been a long time since I saw one

[@something4922]

Dont talk about things you dont understand. Non malicious by default virus/exploit concepts help educate people and developers(including discord) on a paticular issue.

[@oliveoil5864]

so umm, why make it public then

[@bettercalldelta]

@@something4922 I'm a developer so I know exactly what I'm talking about. You are perfect r/iamverysmart material

[@AvgCrazyBlue]

I just hope in another universe cheaters and scammer get punished so hard that they will never even think of doing anything bad online, EVER :)

[@BullyWiiPlaza]

Definitely, scammers need to face serious legal consequences. This has become pretty ridiculous and almost only has upsides for the scammer since he/she will quite easily find some victims and further spread the scam. Besides an account ban, hardware and IP blacklisting, Discord needs to file police reports against scammers in their home countries according to their IPs etc.

[@nicksartandgaming1151]

Help what do I do this has happed to me and I cant get into my disord I dont get the 6 digits pls help im begging

[@BullyWiiPlaza]

@@nicksartandgaming1151 Try to contact the support then if all else fails

[@hi-kt3qr]

The home countries have no jurisdiction to enforce United States law, it will always be US law because Discord is located in the united states of america

[@juliobell1381]

You're a good person @No Text To Speech for making people aware on this situation , its still happening months later as it almost just happened to me !

[@LucyWoIf]

Nobody would even think of making a scam bot or a hack, then release it to the public and not use it to scam or hack

[@fold-squirrel]

well my friend have you ever heard of the job description 'security researcher'

[@fold-squirrel]

and it's not like the 'good' people don't create tools like these, I mean what is the best way to learn how to stop a hacker than to become a hacker

[@appelnonsurtaxe]

This QR code login thing is ridiculous from a cybersecurity standpoint. There's a reason why you don't see other big websites do it ; it's extremely easy to social engineer people into scanning a QR code as they're often seen as just pieces of data that can be read without consequences (and that's fundamentally what they are, except when companies use them for confusing purposes). This login feature is extremely dangerous, you don't reinvent the wheel like that when you're just a VC-funded company that invests more into looks and ease-of-use than actual security.

[@Vj_z]

No Text To Speech + C418 damn, Anyway Thanks for the information

[@ruinsfnbr776]

عندك رابط السيرفر؟

[@Vj_z]

@@ruinsfnbr776 اي سيرفر

[@sophiatheczech1918]

C418 is always good.

[@ImmaPhoenix]

yooo he used my thumbnail idea, let's go bois

[@cr0sad3r70]

I can't believe I actually fell for one of these 💀

[@Sad_Crys]

Same💀💀💀 I just finished unblocking people and messaging them about that fact I got hack 😭

[@gotenblack2542]

ya same i was dumb

[@Sorest2]

@@Sad_Crys Same, unreal I fell for it. It was tricky though.

[@MrGameSheep]

I changed my password, am i safe now?

[@ujaanaich1928]

@@MrGameSheep are you safe? Or did something happen in 1 month?

[@Alexi0s]

Glad I found this! My friend recently got hacked by one of these and I sent this to her because of the concerning information about this scam-

[@DaMakeO]

This one almost got me, Though I reported the server and within an hour they banned the server which was great! I warned my friends about the scam and they didn't know about the server so hey, at least they won't fall for it!

[@josefvs8855]

Fell victim to this scam a second ago! Just secured my account and fixed all the crap with it... Even after 5 months of this video being posted Discord hasn't done A SINGLE THING to stop the scammers in their tracks.

[@darohww]

Idea 1: fully remove qr codes Idea 2: have discord automatically block images with discord qr codes (because literally no one uses this to send to friends anyway)

[@littlebanshee]

QR codes I don’t believe are used ever to send to friends on Discord, it’s another way to login to your account. Or I’m misunderstanding you.

[@sahomes4308]

I just subscribed because all you are saying is true. I love that you are talking about this. You are the only KZbinr who does that. Thanks.

[@envyhvh]

Wouldn’t say at all that the dev is using it, I’ve developed malicious stuff only meant to be tested on yourself such as a token grabber, the problem lies when you decide to deploy it, it being open source has nothing to do with the people who fork the projects intentions.

[@somedude-vp9ti]

Yeah, its just unfounded garbage, its like saying everyone who worked on Metasploit did it for bad reasons

[@undefinedchannel9916]

@@somedude-vp9ti that can be used to pentest it actually serves a good purpose, this on the other hand only serves one bad purpose. i can’t see how it can be used in a not bad way

[@somedude-vp9ti]

@@undefinedchannel9916 so code that shows a severely broken security model discord (a company that seems to not even care seeing all of the security exploits over the years) has only can serve a bad purpose? It also makes no sense why he would publicly post it

[@avant4035]

@@somedude-vp9ti doesnt make much sense. publishing a specifically harmful tool makes you liable to what others do with it, so it is fine to say the dev is acting in bad faith. if he wanted to showcase Discord's broken QR code system then he couldve just made a video about it, or run an experiment with it that would tell users they could have just been hacked, etc.

[@somedude-vp9ti]

@@avant4035 "publishing a specifically harmful tool makes you liable to what others do with it", no?

[@Dominique9325]

If you trust discord with your financial information you already deserve a darwin award. Despite knowing how flawed and insecure the login method is, discord still keeps it.

[@progamingtj1316]

Lol like how he was like speedrunning it as a joke but also just showed everyone how to do it

[@Detective_asparagus]

the scam: scan this QR code! me, who doesn't have a device that is capable of scanning them: I am four parallel universes ahead of you

[@emily1]

That github repository is the reason dangerous code should be protected from the public. There will always be a nefarious figure that will turn a good intentioned vulnerability point out into a fully fledged attack.

[@fold-squirrel]

and that's how they end up patched

[@NamelessJu]

so true, I've had a minecraft mod I made turned into malware by someone who claimed he didn't code it himself and doesn't even know how to code

[@KonyNB]

it should be shared publicly so people can chose to educate themselves on what is happening with these QR code scams or info security in general. It would be worse if it was not available, then only those who find or buy these methods public or not would use them. The same ones who use these techniques to their best gain.

[@hi-kt3qr]

not another propriety software supporter

[@NamelessJu]

@@hi-kt3qr this has nothing to do with proprietary software, he's only saying that *dangerous* code should not be public, he doesn't say anything about code in *general*

[@muhahahahahahayoufool]

The same github page was taken down... but you can still access it with wayback machine . _. what a great way to inform others this exists

[@Cytrexss]

In conclusion : don't trust any weird shit about people 'exposing you'.

[@Jerryfan271]

unfortunately some communities are actually toxic like this and such messages are not out of the ordinary.

[@HalFastIndustries]

If I'm being honest, the whole "you sent a girl nudes so join this server or I'm blocking you" is so over the top and laughably hard to believe. Especially if its sent so many times with literally no change. You know, if I were them, I'd make it a hell of a lot more subtle, like "hey join this server rn" You'd expect dms like that. But hey, I'm not them and I don't plan on ever being them.

[@GoatedKingAubreyDrizzyDrake]

I’ve fallen for this before and it made me look extremely dumb. In addition, I bought nitro as a gift a long time ago and discord autosaved the info to the billing section which is just stupid. Safety measures have been taken and I’m completely safe now, but god that was unnecessary and discord really needs to scan for malicious qr codes, remove tokens being able to bypass 2fa or if it’s possible, remove tokens as a whole, or remove QR codes as a whole. I wish I could’ve seen this video earlier.

[@MrGameSheep]

I changed my password in my discord and email, am i safe now?

[@eliteballer23]

my roblox got unlogged which is scary help me

[@jonahdial7760]

Someone from a dev team had “screenshots” of me scamming someone… so I was like the photo had to be edited because I don’t use that discord account at all. Then I was like bruh when I found this video 🤣 thank you for saving me from a scam!

[@FallenP66]

Mass reporting or mass media of this scam can help. Now media platforms are getting in trouble just for people posting the same shit over and over.

[@IgnitionP]

I was literally just about to click "Yes, log me in" but I decided to stop and think, then came across this video.

[@notjackk]

insanely scummy. probably think they're so smart for scamming people when they just ripped it from github.

[@bbernyy64]

@Sir Avian i wanted to comment that! 🤬

[@xao8035]

I code my own shit, to get pedophiles lmfao.

[@ree7973]

Thank you! I'm crying right now. A friend I don't know enough sent me this msg and I was so scared that something happened.

[@berrybunny8539]

This has been going around again, one of my friends was hacked. There was no long winded message about leaked pictures, it was just "Yo join this discord real quick". I have scan all messages enabled on my account, so the scary part is it doesn't look like it's being picked up by discord.

[@BlueBraviaryGirl]

Same

[@Rebirthed]

One thing i've recently noticed is that these servers are then moving away from verification and impersonating "official" servers for stuff like games to try to scam people. I mod a server and someone reported a scammer and when we asked them for a link to the "server" they moderate, they actually linked to a somewhat reasonable impersonation of the server that was likely rebranded after using this method (had like 20k members, level 3, vanity url, but was still obviously fake as all the channels were empty and you couldnt verify).

[@fitmotheyap]

Before they stole actual servers and sold them now they bot servers and sell 'em

[@tomajjs]

I think the same. ⚠️ *1:* Discord should add some big warning while scanning or some big warning once you log in (only once) that tells you to watch out for scams and tells you some security tips 🔒 *2:* Most important way how to stop scammers is just to do something that will be scammers afraid of. Like that sue. Scammers will be afraid of jail. So they wouldn't do it because you cannot just create new life when you go into jail. So some huge action should be in place. 📜 *3:* People, share like me this video with discord staff under the "Suggestion" category in a ticket so Discord will take some ideas, etc. from this video. It will help and NTTS deserves it. 📌 *4:* Pin this comment, please.

[@RickRollMaster101]

There are 2 warnings while scanning a log in qr code. in red text there is written "Only scan QR code directly take from your browser. Never use a QR code sent to you by another user" and the blue button says "Yes, log me in".

[@Dexzler]

5: Fail the last one

[@HelpIdkAGoodUser301]

Me who doesn’t take pictures of myself in general: I don’t have such weaknesses

[@kaivirin]

Honestly, it was a pretty dumb idea in the first place to allow QR code login. First time I saw it as a login option I thought to myself: "Yeah, that's gonna end well."

[@bbernyy64]

True, discord should probably just remove it

[@hi-kt3qr]

@@bbernyy64 no its literally the easiest way to login simply removing it is the worse solution to any problem

[@bbernyy64]

@@hi-kt3qr 1. Grab ur phone 2. Open discord 3. Scan QR code VS, 1. Press login (most browsers have password autofill) 2. Press ok 2 times

[@hi-kt3qr]

@@bbernyy64 its more like 1. grab your phone 2. open discord 3. scan qr code 4. click yes when discord asks if you want to login on that device 5. fall victim to their scam

[@Luigi64]

Discord needs to remove log in with QR code at this point. It isn't worth the convenience for logging in now

[@sbdvansh]

Here is some information me and a group of people have found: It's hosted mainly in Bangladesh and Romania. It grabs your discord token, but your discord token gets reset when you change your password, discord has said it themselves. A lot of misinformation is being spread about this to make people scared. There is about a five-minute delay the bot takes between you scanning the code and you getting hacked. It doesn't change your password nor unadd your friends as my friends account is completely fine except it sent it to everyone on their friend's list. Hope this helps.

[@Jerryfan271]

some of them do unadd your friends (blocks them). also you didn't watch the video seemingly; it doesn't matter if your token changes as they already have all your user data and possibly personal information. and there is no delay between scanning and you getting 'hacked', unless the bot maker added that in themselves.

[@ludaalt3147]

I fell victim to this scam, what can i do?

[@Jerryfan271]

@@ludaalt3147 change your password and check your blocked list, also look at the audit logs of any servers you have perms in

[@RavenWhiskers]

I had a gut feeling that this was a scam when I had a friend send it to me. I almost clicked it, but decided to wait a little bit. Then, a second friend got hacked, and I received the same exact message with very slight changes, and then I was 100% certain. Both got their accounts back, so that's a good thing.

[@OfficialNotMasterz]

People who is using discord should Tell discord/report this scam discord server or the virus

[@tornadomash00]

@LeGeNDxXxJaaT discord can take down servers

[@lukadoosh8677]

6 months later and I just fell for this scam. Great to see discord is on top of things

[@RikThePixel]

Update on AstraaDev 10-7-2022: Currently it seems like he took his github repo offline or private. My opinion: I agree with the idea that the makers of these tools should be looked at critically however, I do question if he really was malicious. He could have easily sold it without the repository being public. Making a repository public is a stupid move for a highly malicious user. The fact that he took it private now, but made it public to being with makes me question his intentions. Maybe he wasn't malicious after all, or maybe he only did so because he got caught?

[@MittlererTwink]

For the Minecraft background music alone, this video is a 10/10

[@user-gf1fj8wy1e]

These are probably hacked servers thats why they have a lot of members

[@Snipe_hype]

for a non scammer youtuber he sure knows alot about how to make a bot!!!

[@batolgo9502]

anyone else fell for it? :(

[@bubgamingandvlogs3870]

bro it literally says not to scsn qr codes that arent yours 😑

[@Momd1234]

No

[@SkintSNIPER262]

Thanks for the video. Got a DM from guy I played Tarkov with in another server with a server link to join. Wanted me to scan a QR code to verify the red alert in my head went off. Quickly searched on KZbin and looks like I was right.

[@Curlyludwig]

I just got this scam message but didn’t scan the code. Thanks for making this video

[@RabbitRiceBall]

I fell for this.And I've been paranoid since.

[@btarg1]

It's quite impressive that they got a simple QR code to token log people, I would love to see technical deep dives on these

[@Jerryfan271]

it's not really. the discord developers gave everyone exactly what they needed to start qr phishing, with the qr code login feature. this scam has been around for years and nothing has been done, it's only getting attention now because of a particularly successful version of it.

[@BabanDlh]

you put a minecraft music, I legit almost cried, I hate you but I love you

[@cmjn7158]

Hope you'll make more videos talking about discord scams, they are great !

[@SadhanaTyler]

Thank you so much for this !!! It just happened to me and was very skeptical. Need to have more risk for Scamming

[@lundee3333]

i hope they actually sue a scammer for 7 million one day

[@giovannyfnf4370]

Your actually the goat, This helped so much thank you.

[@secretseason4889]

6:50 they should add it so, when you press the button, you will get redirected to a part of the login where there is the warning, and you will have to check the box where it has next to it "I understand and accept", and then after 5 seconds, you should be able to log in. Discord definitely should warn people with a proper message like i just described.

[@JefferyStalker]

subscribed, just found you and your really underrated, you deserve atleast 500k subs with this content

[@torico7022]

Quick reminder to delete every auto sent message if you fall for it so your friens don't too

[@NickmadeStupidVideo]

the admin in the group im in made a new script that auto deletes and mutes anyone that posts any of those kind of links or scam messages, it works well and its spooky when we see all the channels light up at the same time multiple times a day, but no message is there. its sad that the users have to implement this kind of stuff because the staff doesnt care

[@littlebanshee]

I got something similar, the one I got just said something like check general. Luckily I never clicked it but that’s a longer story on why. Thanks for making people aware. I hope Discord can better protect and handle this in the future. It makes sense why it keeps happening especially if they get income from it but sadly I do not see Discord suing, it’s happening to users not them. Only way they might is if people start saying they won’t use Discord due to the risk/issue.

[@Gomek_]

Fun fact: A popular roblox games server got hacked (the owner scanned the code) and the 12k member server got redirected to the server and the original was deleted.

[@ScrapBlox]

Wow this video is amazing. Discord seriously needs to watch this entire video and fix it

[@weatheradventures6834]

Thanks for this video, with all of your statements, I agree with them all and it’ll definitely discourage people to scam other people on Discord. I decided to like the video and Subscribe to your channel. I appreciate your hard work, and I hope the future ahead of us, will be better and less worrisome with less or no scams at all which is what I hope for. 😁