How do Discord server takeovers and fake announcement links work?

30 September 2026

Discord server takeovers are a method attackers use to gain control of a cryptocurrency community's official Discord server, then post fake announcements containing phishing links. The takeover itself is usually accomplished through a compromised administrator or moderator account, often via a credential-stealing phishing attack or a malware-infected session token. Once the attacker has administrative privileges, they can post messages that appear to come from the project team, announce fake token launches, airdrops, or security updates, and include links to malicious websites that drain wallets.

How the takeover happens

Attackers typically target Discord server staff members - administrators or moderators - who have permission to post in official announcement channels. The methods used to compromise these accounts include:

• Credential phishing: A staff member receives a direct message that appears to be from Discord support or a trusted project partner, asking them to "verify" their account by logging in on a fake Discord login page. The attacker captures the username and password.
• Token theft: A more sophisticated approach involves tricking the staff member into running a malicious program or visiting a site that steals their Discord session token. This token allows the attacker to authenticate as that user without needing a password, and it can bypass two-factor authentication if the token was captured after the user already authenticated.
• Malware on the staff member's device: Keyloggers, remote access trojans (RATs), or browser-stealing malware can capture Discord credentials or session tokens directly from the device.

Once the attacker has administrative access, they can post messages in locked announcement channels, delete legitimate messages, change server settings, and even kick or ban other staff members who try to intervene.

The fake announcement and its link

The announcement typically mimics the style of the project's genuine communications. Common themes include:

• "Emergency wallet migration required" - claiming a security issue means everyone must move funds to a new contract address.
• "Token airdrop claim now live" - offering free tokens in exchange for connecting a wallet.
• "Partnership announcement" - linking to a fake DeFi platform that requires approval of an unlimited token spending contract.
• "Server verification required" - telling users they must click a link to "verify" their Discord account or risk being banned.

The link in the announcement will point to a domain that closely resembles a legitimate site. For example, a project called "RabbitTechnology" might see a phishing link to rabbittechnology.xyz (note the extra "t") or rabbit-techn0logy.com. The site will be a front-end clone of the real project's interface, but any wallet connection, signature request, or transaction approval will drain the user's assets.

How to check a suspicious Discord announcement

When you see an announcement in a crypto Discord server, assume it might be fake until you verify it, especially if it asks you to take an action with your wallet. Use these steps:

1. Check the channel and the author: Look at the channel name. Genuine announcements usually appear in a dedicated "announcements" or "news" channel, not in a general chat. Hover over or tap on the author's name to see their full Discord tag and role. If the role says "Admin" or "Moderator" but the user's tag looks unfamiliar, that is a warning sign.

2. Compare with official sources: Go to the project's official website (which you should have bookmarked from a trusted source, not from a search engine). Check the project's official Twitter/X account, Medium blog, or Telegram channel for the same announcement. If it is not cross-posted there, treat it as suspicious.

3. Examine the link without clicking: On desktop, hover your mouse over the link. Your browser or Discord will display the full URL at the bottom of the window. On mobile, press and hold the link to see the URL preview. Look for:

4. A different domain than the official one (even one character off).
5. A subdomain that mimics the official name, like claim.rabbittechnology.xyz instead of rabbittechnology.xyz/claim.

6. A domain that was registered recently - you can check this with a WHOIS lookup service. Most phishing domains are less than a week old.

7. Do not click the link at all: Instead, navigate to the official site yourself by typing the known URL into your browser. If the announcement is legitimate, you should be able to find the same information there.

8. Ask in the server's general chat: If the announcement seems urgent, wait a few minutes and ask other members or a known staff member (in a public channel, not a DM) whether the announcement is real. Attackers often disable public chat or mute non-admin members during a takeover to prevent this.

What to do if you suspect a takeover

If you see a suspicious announcement that appears to come from an admin account, do not click any links. Report the message to Discord by right-clicking it and selecting "Report." If you know a staff member outside of Discord (for example, through email or Twitter), contact them directly. The real team will typically disable the compromised account, restore the server from a backup, and issue a warning.

If you clicked a link and connected your wallet, revoke any token approvals immediately using a block explorer like Etherscan's "Token Approvals" tool or a dedicated revoke site (one you navigate to yourself, not from a link). If you signed a transaction, your funds may already be gone.

Back to phishing