A Discord DM lands from someone you have never spoken to. It uses a name that is not yours and refers to a conversation you never had. You reply, because you are a decent person, that they have the wrong account. And instead of the “oops, sorry” you would expect, you get: “Haha my bad! Nice to meet you though. Where are you from?”
That second message is the whole story. Nobody who genuinely DMs the wrong person wants to keep talking. This one did. Within twenty messages I had been promoted to their “first American friend”, asked what games I play, told about a game their friends play every night, sent a link to it, sent a second link to an “emulator” I would apparently need, and given their player ID to enter at sign-up so we could be on the same team. Twice. Then: “Did you install it yet?” “It only takes a minute.” “Are you there?”
I was there. I was taking screenshots.
What the “game” is
This is the “try my game” scam, and it has been circulating on Discord for years in a few costumes: beta-test my indie game, help me test my build, play this with us. Malwarebytes documented a wave of it in January 2025. The download was never a game. It was an installer wrapped around an infostealer, with families like Nova, Ageo and Hexon doing the work, and the shopping list is exactly what you would expect: saved browser passwords, session cookies, autofill data, stored card numbers, crypto wallets, two-factor backup codes, and the Discord token itself.
The Discord token is the clever part. With it, the attacker is you on Discord, without ever touching your password or your MFA. Then your friends get the same DM, from you, and they trust it, because it is you. The scam funds itself in contacts.
The “emulator” is the bait within the bait. Android emulators for Windows are a real product category, so “you need an emulator to run it on PC” sounds like ordinary tech advice. The file behind their link is whatever they want it to be. And the player ID? Either a referral code that pays them for your sign-up, or the hook into a fake game that will shortly need you to buy a bundle to “help the alliance”.
The rule: nobody you met today gets to run code on your machine. Not a game, not an emulator, not a “client”, not a password-protected zip. If the game exists, it exists on Steam or in an app store, where you can find it without their link.
The script, so you recognise it
- The wrong-person opener. Same trick as the “are we still on for lunch?” texts. A mistake is disarming, and your reply confirms a live human.
- Fast warmth. First American friend, always wanted to visit, you seem so nice. It costs them nothing and it makes “no” feel rude.
- Steering. Every answer you give is met with a question that moves the conversation toward games, apps or money.
- The link. Often hosted on Dropbox, Google Drive, a throwaway site, or Discord’s own CDN, which makes it look like it came from Discord.
- The helper. An emulator, a launcher, an “anti-cheat”, a zip with a password so the file host cannot scan it.
- The code. Their ID, their invite, their referral.
- Pressure. “Did you install it yet?” on repeat. Real friends do not audit your downloads.
What to do
Stop replying. Open their profile, Block, then Report. Ten seconds, and it feeds Discord’s detection for the next target. Then spend two minutes in Discord’s settings: under Privacy and Safety, turn off DMs from server members for servers you are not close to, leave the message-request filter on so strangers land in a separate queue, and keep the DM scanning option at its strictest. Most of these DMs come from someone who joined a public server you are also in, and that one setting closes the door.
If you have kids on Discord, this is the one to show them. The scam is aimed squarely at gamers, and a fourteen-year-old with a new friend who wants to play together is not going to see the shape of it unless someone has drawn it for them.
If you already ran it
- Pull the network cable, or turn off Wi-Fi. Do not shut the machine down yet; if anyone needs to look at it, the evidence is in memory.
- From a different device, change the password on your email first, then banking, then Discord, then everything the browser had saved. Assume all of it was taken in the first minute.
- Sign out of all sessions everywhere. Stolen cookies and tokens survive a password change until you do this. Discord’s “log out of all devices” is under Privacy and Safety; Google, Microsoft and Steam all have the same.
- Re-enrol your MFA on anything whose backup codes were stored on that machine.
- Wipe and reinstall. An infostealer that ran with your rights on your PC is not something a scan “cleans”. Rebuild it, restore files from backup, and treat every credential that machine ever saw as burned.
- Warn your Discord friends that anything from you about a game last night was not you.
For the technicians
Discord is on a lot of work machines now, sometimes officially. The controls that matter: block unsigned executables from user-writable paths with AppLocker or WDAC, so a “game” from Downloads cannot run at all; alert on new executables written under %AppData% and %Temp% followed by outbound connections to Discord webhooks and Telegram bot endpoints, which is how most of these stealers exfiltrate; and treat a Discord token compromise like a session hijack, because that is what it is. If someone reports a colleague’s account sending them game links, the colleague’s browser passwords are already gone. Start the reset there, not with Discord.
Nothing about this attack is sophisticated. It is a stranger, a compliment, a link and some nagging. The defence is equally plain: a stranger with a download is not a friend, and nobody you met today runs code on your machine.
Had one of these DMs? Paste the script (minus the link) in the General forum so others can see the pattern. If you ran the file and are not sure what to do next, the Help forum is the place to ask.