New Red Teaming Tool RedTiger Attacking Gamers and Discord Accounts in the Wild
RedTiger, an open-source red-teaming tool, has been exploited by malicious actors to extract sensitive information from Discord users and gamers. Originally released in 2025 on GitHub, the tool includes penetration-testing utilities such as network…
RedTiger, an open-source red-teaming tool, has been exploited by malicious actors to extract sensitive information from Discord users and gamers. Originally released in 2025 on GitHub, the tool includes penetration-testing utilities such as network scanners and OSINT tools . However, its infostealer module has been co-opted for nefarious purposes, with malicious payloads identified since early 2025.
RedTiger is favored by attackers due to its modularity and ease of customization, similar to the Cobalt Strike framework . The tool is distributed as PyInstaller-compiled binaries, often disguised as game cheats or mods, to deceive users into executing them.
The malicious RedTiger-based infostealer targets Discord accounts by injecting JavaScript into core application files to intercept API traffic. It identifies tokens through regex searches in Discord's databases, verifies them via API calls, and extracts user information, including email addresses, multi-factor authentication status, and subscription details. Even password changes are captured as the malware intercepts updates to billing endpoints for services like Stripe and Braintree, collecting credit card information, PayPal details, and Nitro purchases.
Beyond social media platforms, the malware targets web browsers such as Chrome, Firefox, Edge, and Opera GX to collect cookies, passwords, browsing history, and credit card data. It also copies game files from Roblox and cryptocurrency wallets like MetaMask, archiving .txt, .sql, and .zip files containing keywords such as "passwords."
RedTiger, an open-source red-teaming tool, has been exploited by malicious actors to extract sensitive information from Discord users and gamers.
The malware employs browser_cookie3 to extract Roblox-specific cookies, revealing account information via API queries. To ensure persistence on Windows systems, it is placed in startup folders, though its implementation on Linux and macOS requires manual adjustments.
To evade detection, the malware scans for sandbox indicators such as usernames and hardware IDs associated with analysis tools and self-terminates if found. It edits the hosts file to block security vendors and generates numerous junk files and processes to hinder forensic analysis.
Data exfiltration is executed by compressing stolen data into zip files and uploading them to anonymous GoFile storage. The attackers receive these links via Discord webhooks, which include victim IP addresses and geolocation data.
Additionally, RedTiger uses OpenCV and Pillow libraries to capture webcam images and screenshots. Netskope identifies it as Win64.Trojan.RedTiger and advises gamers to scan downloads and enable two-factor authentication.
Experts caution that infostealers are likely to evolve, with more variants anticipated. Gamers are advised to monitor their accounts and employ antivirus solutions with behavioral detection to mitigate risks.
Based on reporting by Cyber Security News.