What is a token grabber?
A token grabber is malware designed to steal your Discord token, the key that authenticates your account. With that token, an attacker can control your account without a password.
What is a Discord token?
The token is a secret string that proves to Discord that it's really you. Your app stores it locally to keep you logged in. Anyone who gets hold of it can log in as you, without a password and without triggering two-factor authentication.
How a token grabber steals your account
The trap almost always arrives through a file or link you're pushed to open:
- Fake software, cheats, cracks, or "Discord tools" to download.
- Fake "free Nitro" offers and phishing links.
- Booby-trapped extensions or scripts.
Once run, the program reads the local files where the token is stored and sends it to the attacker, often within seconds and without the slightest visible sign.
The risk for your servers
With your account, the attacker sends scams to your friends and joins your servers. And if you're an admin or moderator, a stolen token is one of the most common ways to nuke a server from the inside: it's the starting point of many attacks.
How to protect yourself from a token grabber?
- Don't run anything untrusted. Cheats, cracks, Discord "tools", and files received from unknown sources are the number-one vector.
- Be wary of "free". "Free Nitro" and links too good to be true are phishing in the vast majority of cases.
- React fast if you're compromised. Change your password immediately: that invalidates the stolen token and logs the attacker out.
- On the server side, apply least privilege. That way, even a compromised staff member's account can't destroy everything.
Frequently asked questions
Does a token grabber steal my password?
No: it steals the session token, which is enough to access the account without the password. That's exactly what makes it dangerous.
Does two-factor authentication protect against a token grabber?
Not directly, because a token that's already stolen bypasses the login. But it protects the password change and the reconnection, and changing your password invalidates the stolen token.
How do I know if my token has been stolen?
Watch for any unknown activity: messages you didn't write, servers joined or left, scam DMs sent in your name. At the slightest doubt, change your password.
What's the connection with a nuke?
A token stolen from an administrator is one of the most common ways to nuke a server: the attacker acts from a legitimate, privileged account.