Report: collaboration tools like Slack and Discord are increasingly being used to spread malware, often using the tool's own CDNs and APIs to evade detection
There's A New Malware Out There Snatching Users' Passwords TechRadar : Discord and Slack are becoming hotbeds for malware Ionut Arghire / SecurityWeek : Collaboration Platforms Increasingly Abused for Malware Distribution, Data Exfiltration
Context & Ripple Effects
The original report flagged how collaboration platforms were being turned into malware delivery channels, with attackers riding Slack's and Discord's own infrastructure — their CDNs and APIs — so malicious traffic blends in with legitimate enterprise and gaming traffic. That early warning proved durable: months later, Sophos researchers documented Discord's CDN becoming a mainstream distribution channel for data-stealing malware.
Since then the pattern has spread along two axes: automation (bots inside Discord and Telegram now host and execute malware schemes) and adjacent developer platforms, where Recorded Future has catalogued systematic abuse of GitHub's services and Trend Micro showed Codespaces port forwarding being weaponized for hosting malicious scripts.
First-order effects
- Slack and Discord face detection-and-response costs on infrastructure they provisioned for legitimate file sharing and API access, while their enterprise customers inherit risk from a channel most security teams treat as internal communications, not an attack surface.
- Data-theft operators gain free, reputable hosting: malware payloads served from a collaboration platform's CDN inherit its TLS certificates and domain reputation, defeating URL- and domain-based filtering.
Second-order effects
- Security vendors must shift detection from blocklists toward content inspection and behavioral analysis of traffic to trusted SaaS domains, raising the price of tools that rely on allowlisting popular platforms.
- The playbook is portable across any platform with generous free hosting — the same abuse pattern recorded on GitHub Codespaces and detailed across GitHub more broadly by Recorded Future means every developer-services provider with CDN-like features becomes a candidate target.
Third-order effects
- If trusted-platform abuse keeps scaling, the industry moves toward treating any user-hostable content on major SaaS platforms as untrusted by default — pressuring platform owners into active content scanning that erodes the privacy and openness that made these communities attractive, a tension already visible in Discord's struggles with spam and scams in its crypto and Web3 communities ([[a:979416]]).
The trend: Attackers are systematically converting trusted collaboration and developer platforms' free hosting and automation features into commodity malware infrastructure, forcing security away from domain reputation toward content-level trust decisions.