WatchOut #19 · Investigating
Fake Discord checks tell you to paste a command
Website Social media Messaging app ImpersonationTechnology & workplace scams
Who may be targeted: Discord users, gamers, children, parents, teachers, and anyone who encounters a Discord-branded human-verification page.
What we are seeing
A page that looks like Discord may show a Cloudflare-style check and tell you to press Win + R, paste text, and press Enter. That is not a human check. It can run a hidden PowerShell command on your Windows computer. Close the page and do not paste or run anything.
Warning signs
- The address is not Discord's official website.
- The check tells you to open the Windows Run dialog.
- You are told to paste text and press Enter.
- The page uses an encoded PowerShell command.
Reported addresses
Written so they cannot be clicked. Do not retype them into your browser.
discord-eu[.]cfd
Source and limitations — what this alert does not establish
- The page operator, exact payload, malware family, and number of people targeted were not confirmed.
- The supplied command is encoded; do not decode or execute it on a normal computer as a way to investigate it.
First observed Sep 9, 2026. Published Sep 10, 2026. Published by the Cybersecurity Reach Foundation.
Send this to someone it could protect.