Discord Account Takeover Triage & Recovery Breach Alert

Source triage for "Email/account doesn't exist anymore" + zero notification lockout cases.

Preset:

Lockout Symptoms Observed

5 symptoms selected
Adjusting symptoms instantly recalculates threat telemetry.

Calculated Attack Vectors

Stealer Token Compromise
Info-Stealer Malware + Token Reassignment 78%
Malware extracted Discord LevelDB auth token, decrypted browser cookies, immediately bound a disposable email (@rambler/temp-mail), and triggered full session invalidation across all devices.
Email Inbox Filter Interception 65%
Threat actor accessed your webmail session via stolen browser cookies, set an automated filter rule to auto-delete or forward emails from noreply@discord.com to suppress alerts.
QR Auth / Rogue Bot Hijack 25%
Discord mobile QR login proxy bypassed 2FA; however, changing primary account email requires entering account password, indicating token or password theft was also leveraged.
Billing Fraud / Chargeback Termination 10%
Discord Trust & Safety instantly disables and disassociates accounts that initiate payment disputes. If no chargeback was filed, this vector is ruled out.
⚠️

Why did you receive NO email notification from Discord?

When attackers compromise browser sessions, they routinely log into Gmail/Outlook webmail first and inject silent routing rules. The official email saying "Your Discord email was changed to attacker@xyz.com" was received, but instantly moved to Trash or permanently deleted before your phone buzzed.

STEP A

Gmail Filter Inspection

Navigate to Settings → "See all settings" → "Filters and Blocked Addresses". Look for any rule containing:

Matches: from:(discord.com OR noreply) → Do this: Delete it, Skip Inbox

Also check Forwarding and POP/IMAP to verify no unknown mail forwarder is set.

STEP B

Outlook / Hotmail Rules

Gear Icon → "Mail" → "Rules". Check for rules set to move Discord keywords directly to "Deleted Items" or mark as read immediately:

Condition: sender address includes 'discord' → Action: Move to Archive / Delete

Inspect "Recover items deleted from this folder" for the original change alert.

STEP C

Inspect Trash & Bin Folders

Search specifically for deleted messages within the last 48 hours using native search syntax:

in:trash subject:(discord OR verify OR "email changed")

Finding this email provides the new attacker address and confirmation link needed for your ticket.

Enjoy this tool? Build your own with Super