Lumma/AsyncRAT - Discord CDN Used for Payload Delivery

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•6

Detects non-Discord processes downloading from Discord CDN attachment endpoints (cdn.discordapp.com/attachments or media.discordapp.net). This activity is often associated with malware families like Lumma and AsyncRAT using Discord CDN to host and deliver stage-2 payloads.