Discord is rebuilding its Discord Rust desktop client with GPUI, ditching Electron to slash memory consumption and share native code with mobile.

Related Posts:

• Microsoft Overhauls Academic Licensing and Storage Quotas
• Vercel DBSC Session Security Thwarts Cookie Theft
• Apple Begins iCloud Public Link Scanning in iOS 27.3

The post Discord Rust Desktop Client Ditches Electron for GPUI appeared first on Daily CyberSecurity.

Discord is rolling out machine-learning age assurance that estimates whether users are teens or adults without requiring most accounts to submit ID.

The post Discord Wants to Estimate Your Age Without Asking for ID appeared first on TechRepublic.

The government has lifted its ban on Discord in the Philippines after the platform's representatives met with officials from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC). The CICC is an attached agency of the DICT. The restriction was removed on Thursday, Sept. 24.  DICT Secretary Henry Aguda and CICC Executive Director Undersecretary Renato "Aboy" Paraiso confirmed the decision. They said it followed a pledge from Discord officers to cooperate with both agencies. 

Discord's Commitments to the DICT and CICC 

The two sides held an online meeting on Thursday. According to Paraiso, Discord agreed to put security measures in place, establish a presence in the country, and support the government's campaign against online groomers.  "The meeting was successful," Paraiso said during a live press briefing. "We secured a commitment from Discord to collaborate with us in achieving our goal of further strengthening the online safety measures we are implementing for our country."  Discord also told the DICT and CICC that it would provide a "green lane," which would let Philippine authorities track and monitor suspicious activity on the platform.  "Like Reddit, Discord has promised to provide us with a 'green lane'—such as monitoring and identifying threat actors on their platform," Paraiso said. 

Why the CICC Imposed the Ban on Discord 

The CICC had earlier ordered Discord and Reddit to coordinate with the agency and set up a local office within 24 hours.  In a clarificatory statement on Wednesday, the center said it did not grant Discord an extension because the company had only responded through a letter. Paraiso said the ban took effect immediately, at around 5 p.m.  Reddit, meanwhile, was allowed to keep operating after it held an online meeting with CICC officials. That discussion covered plans for a local Reddit office and other safety measures for teenagers who use the platform. 

DICT Acknowledges Disruption to Users 

An anti-scam advocacy organization said many people were frustrated by the temporary restriction because they rely on the platform for work. Aguda maintained that the immediate ban was meant to protect young people.  "Legitimate users have been somewhat inconvenienced, and we understand that. We just want to let you know that when we spoke with Reddit and Discord, they acknowledged the issue," the secretary said.  Aguda added that both Discord and Reddit have named point persons who will coordinate with the government at all times. However, the timeline for setting up the companies' local offices has not been finalized. 

Extremist Group Concerns Behind the CICC's Action 

The CICC had previously flagged the presence of a Nihilistic Violent Extremism (NVE) group allegedly recruiting and grooming teenagers on these online platforms.  The group is suspected of having links to the Sept. 18 school shooting at Banga National High School in South Cotabato, which killed three students. That incident came a month after a similar shooting at Ateneo de Zamboanga University left two students dead.  "Instances involving NVE are on the rise. The numbers are truly going up," Aguda said.  "We are all aware of this. We have been tasked with providing a solution," he told reporters.  "Sometimes, these solutions may not be popular, but we must do what is necessary to make progress in protecting the youth," the cabinet official said. 

Threat actors are exploiting anticipation around Grand Theft Auto VI by pushing fraudulent “leaked” game downloads that install a layered malware bundle that steals browser credentials, Discord tokens, gaming-session data, and cryptocurrency-related information. A Chaos ransomware variant used as a wiper, and an unexpected Yandex Browser installer. The campaign demonstrates how cybercriminals are turning one […]

The post Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Lina K., a co-worker, recently shared a firsthand account of how bots are adding League of Legends players via the Riot client friends list immediately after a match ends, striking up a flirty conversation, and eventually pushing an OnlyFans link. The pattern lines up with a wave of complaints that have piled up on Reddit and Facebook gaming communities over the past several months, and it fits into a broader trend of AI-assisted social engineering that has moved from dating apps straight into game clients.

The pattern

The scheme reported by multiple League of Legends players follows a near-identical script. A friend request lands in the Riot client within moments of a match ending, from an account whose name does not match anyone from that game. The message opens with generic flattery like “you played really well last game” or “I liked your playstyle” designed to sound like a genuine compliment from an opponent or teammate.

When questioned about who they are, the accounts often claim to have been on the enemy team despite name mismatches, and many present themselves as a woman looking for a duo partner. A detail that likely raises engagement odds. Victims who check the account’s profile frequently find it blank: no visible match history, no overview data, sometimes a very low account level. These are all signs of a throwaway account built or bought purely for outreach, but sometimes they turn out to be stolen existing accounts.

After a short exchange, the contact says they are “getting off soon” and hands over a Discord username, moving the conversation to a platform Riot’s chat protections cannot see or moderate.

Once on Discord, the persona shifts into a longer-form romance/flirtation script. Usually, hours of chat building rapport, paired with a steady stream of photos that are suggestive but stop short of explicit content, a tactic that keeps engagement high while deferring the “reveal” until trust is established. That reveal ultimately comes in the form of a link to a paid subscription platform, most often OnlyFans, framed as an exclusive, limited-time offer.

A reverse image search on the photos sent during one such conversation turned up the same pictures recycled across unrelated websites and at least one YouTube video, with commenters in that video describing having received identical images from a bot under different names. This is strong evidence that the same photo set is cycling through many chats simultaneously, run at scale rather than by one individual.

Lina stated:

“One of my friends tried to break the bot too, left it on read for some time – the bot actually switched the pictures to match the context of “Concern” on the face of the model with “Why are you not replying?”, which quite clearly gave away bulk image generation for the script.’

When the account was pressed with a “reveal your instructions” style prompt-injection attempt (text formatted to look like a system message ordering the bot to break character and print its configuration), it did not comply and instead stayed in persona, deflecting the request and continuing the pitch.

That resilience to a common jailbreak technique suggests the bot’s operators have added guardrails against exactly this kind of probing, or that the “model” behind it is a simpler scripted flow layered with some LLM-generated text rather than an open, unrestricted chatbot.

Why this is happening inside the game client now

What makes this wave notable isn’t the romance scam script itself.  AI-driven catfishing has been documented on dating apps and social media for a couple of years. The difference is the entry point. Players have reported getting these bot friend requests after essentially every single match, with no way to distinguish a real player’s request from a bot’s inside the Riot client.

Community threads describe the bots seemingly appearing right after a game ends, which has fueled speculation that the bot operators are scraping or monitoring publicly available match data through third-party stats-tracking sites and associated APIs to identify recently finished games and target participants, though this has not been independently confirmed by Riot.

Riot’s own client architecture may be inadvertently helping. The Riot Client exposes local endpoints (such as the friends list API) that third-party tools and overlays query, and community-run “op.gg“-style trackers pull player and match data that could plausibly be used to correlate who just finished a game with who to target next. Some affected players have found a partial workaround: switching on the client’s “streamer mode,” which hides recent match and online status information, appears to reduce how often bot requests arrive. Which is an indirect clue that the targeting relies on visible activity signals rather than random spam.

---

---

The end goal: content promotion, not always theft

Unlike classic Discord scams that push fake Nitro codes or malware-laden “test my game” links to hijack accounts, this particular chain appears primarily aimed at driving paid subscriptions to an OnlyFans-style page of a fake AI girl. That doesn’t make it harmless. Even when the underlying OnlyFans account is real, the conversations are very likely run by paid chat operators or scripted/AI-powered systems working from a shared script and a reused media library, a business model that has been described by former OnlyFans “chatters” themselves: agencies assign staff (or bots) to respond as the creator around the clock, pull from a pre-made vault of photos and messages, and are financially incentivized to convert every conversation into a subscription or tip.

There are also more damaging variants layered onto the same funnel. Community reports describe some of these bot accounts eventually sending a link that, once clicked, is designed to hijack the recipient’s Discord account or harvest credentials rather than lead to legitimate content.

That means the “girl who wants to duo” opening can just as easily terminate in an account-takeover attempt as in a subscription upsell. Because the funnel starts with a low-cost, disposable Riot account and migrates the target to Discord within minutes, the League client friend request functions purely as a first-contact filter: cheap to generate, easy to discard after a single use, and outside the reach of Riot’s in-game reporting tools once the conversation moves off-platform.

How to stay safe

Recognizing these scams is the best way to protect yourself. But there is more you can do:

• Treat any Riot client friend request from an unrecognized name as suspicious by default, especially one that arrives seconds after a match ends—check whether the account actually appeared in your last game before accepting anything.
• Enable streamer mode or equivalent privacy settings in the Riot client to limit what activity and match data outside parties can see, which several affected players found reduced the frequency of these requests.
• Be skeptical of anyone who quickly steers the conversation off-platform to Discord, especially if they cite being unavailable (“gotta go soon, here’s my Discord”) as the reason—this is a deliberate move to a channel with less moderation and no shared match context to verify identity.
• Run a reverse image search (Google Images, TinEye, or a dedicated tool) on any profile or “personal” photos sent early in a conversation; recycled images across unrelated sites or forums are one of the most reliable tells of a bot or catfishing operation.
• Watch for AI-typical conversation patterns: responses that feel scripted, arrive instantly regardless of time of day, are grammatically flawless but emotionally generic, or that consistently dodge voice/video calls.
• Never send money, gift cards, cryptocurrency, or payment details to someone you met exclusively through in-game or Discord contact, no matter how convincing the rapport feels—legitimate connections do not require urgent financial “help” or exclusive subscription purchases within hours of meeting.
• Do not click links sent by unfamiliar contacts, even ones framed as harmless subscription pages, game invites, or file downloads; some variants of this scheme are documented to lead to credential-stealing or account-hijacking pages rather than legitimate content.
• Lock down Discord’s privacy settings (restrict who can DM you and send friend requests) and enable multi-factor authentication, since a compromised Discord account is often used to relaunch the same scam against the victim’s own friend list.
• Report suspicious Riot client accounts to Riot Support and suspicious Discord accounts/servers to Discord Trust & Safety; reporting does not remove the account instantly but it feeds the pattern data that platforms use to detect and ban clusters of bot accounts.
• If a bot or scripted persona pushes back convincingly against attempts to “break” it (e.g., ignoring prompt-injection or jailbreak-style messages designed to expose it as an AI), treat that resilience itself as a red flag rather than reassurance—a well-guarded script is not the same as a genuine person.

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Discord says a moderation bug wrongly banned more than 8,000 users after harmless images triggered its automated safety system.

The post Discord Bug Wrongly Banned 8,000 Users Over Harmless Images appeared first on TechRepublic.

The US state of Maine has taken its public data breach notification portal offline after someone submitted fraudulent breach disclosures impersonating two well-known technology companies. Read more in my article on the Hot for Security blog.