T1528/T1555.003: Discord Token Theft via Local Storage/Leveldb Access (SectopRAT/FakeAgent)

Tim Peck@timpeck

•updated Jul 22, 2026•4•0•18

Detects instances where a process other than the legitimate Discord client or its updater accesses the Local Storage/leveldb directory. This path contains cached authentication tokens and session data, making it a frequent target for credential theft malware such as SectopRAT in the FakeAgent campaign.