Discord Process Hijacking or Restart

Tim Peck@timpeck

•updated Jan 2, 2026•6•2•99

Detects the termination of Discord processes or a restart using Update.exe with the '--processStart' argument. This behavior is characteristic of the VVS Stealer, which uses this technique to inject malicious JavaScript for session hijacking.