Came across an active campaign recently targeting Discord users through a fake browser-based UNO card game (the link is removed so i won't get banned here i guess). Thought I'd share a quick breakdown of how it works and where the actor completely messed up their OPSEC.

Timeline

Looking at the infrastructure timestamps, the operation was stood up and deployed over the weekend of September 6–7, 2026:

• September 6 (~22:00–23:40 UTC): The actor deployed the site to Hostinger, set up the backend database, compiled the UnoApp.exe build, and ran initial tests with co-conspirators.
• September 7 (05:00 UTC onward): The campaign went fully live. The actor began distributing invite links across Discord/gaming channels to lure victims into the lobbies.

The Lure

Victims join a working web lobby to play UNO. When the host hits "Start Game", the web UI pops up saying the match only runs in the desktop client and tells them to download UnoApp.exe (~119MB, hosted on Dropbox). The actor also uses fake female personas in chat to convince people that voice chat only works in the desktop app, and specifically checks if victims are on Windows before starting.

The Binary

The file was 0/70 on VirusTotal when I first checked.

• Packaged as an NSIS installer wrapping an Electron build.
• Instead of plain JS in app.asar, the core logic is compiled directly to V8 bytecode (app.protected.jsc) via Bytenode to dodge static heuristic scanners.
• All internal strings were encrypted with AES-256-CBC. Once decrypted, it turned out to be a custom build of HADES Infostealer / RAT.
• Capabilities: Chrome App-Bound encryption bypass via DPAPI/LSASS token duplication, browser credential theft, crypto wallet extraction, Discord client patching (blinds the login QR code to force manual 2FA entry), and a ransomware lockscreen command (kilit.png).
• Exfiltrates stolen bundles directly to a hardcoded Telegram ID (8690153935) and a C2 domain (hellodcuser.com).

The OPSEC Failure

The funniest part was the web lobby infrastructure. The threat actor hooked their site up to a public Supabase instance with unauthenticated tables.

I dumped the database and found 53 rooms, 134 members, and all their raw chat logs. In one of the private test rooms right after deployment on September 6, the operator logged in under his real name ("Türkay"), chatting with a co-conspirator and literally writing: "this is our anonymous place… we will transfer the stolen data from here". Out of 44 unique users who entered the lobbies once it spread on September 7, around 40 were pushed to download the payload.

I put together the full writeup with the extracted AES key, hashes, C2 indicators, and chat transcripts on my site:

walliez-xyz/unoplay (you can switch the – to the . )

(All abuse reports have already been submitted to Dropbox, Supabase, Hostinger, and national CERT).