Discord Desktop Core JavaScript Loader Tampering

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•4

Detects when a non-Discord process creates or modifies both 'index.js' and 'package.json' within a Discord desktop core module directory. This file pair is critical for Electron module loading and is often targeted by malware like VVS Stealer to establish persistent session interception.