Fake business documents turn Discord into a malware command hub
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, October 19th, 2026.
Windows users can be infected by a fake business proposal that places a malicious shortcut beside a legitimate-looking PDF. If the implant runs, CikaBika Bot registers the device in Discord, gathers system information, captures a screenshot, and waits for attacker commands. It can execute commands, move files, and support surveillance. Ngrok is used for additional data transfer. The campaign’s initial distribution method has not been confirmed.
Using legitimate chat and tunneling services can help malicious traffic blend into normal network activity. Leaders should not assume that familiar cloud platforms are automatically low-risk destinations. Defenders should inspect disk-image and shortcut execution, hidden PowerShell activity, suspicious Discord channels, and unexpected Ngrok transfers. The attempted Microsoft Edge sideloading route may not work on every system, but the broader command-and-control approach remains important.
The larger lesson is that attackers can rent trust from everyday services instead of building obvious infrastructure. Block or investigate suspicious disk-image lures and correlate Discord or Ngrok traffic with unusual endpoint activity.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
