[SCAM] Hiring Discord Moderator from @Saruc

[ryzaadit]

Hi everyone, I warned everyone who is applying for the jobs: https://bitcointalk.org/index.php?topic=5446246.msg61996275#msg61996275
Scammers Profile Link: https://bitcointalk.org/index.php?action=profile;u=1306528
Suppor Flag : https://bitcointalk.org/index.php?action=trust;flag=3144

My discord just got hacked, after contacting him 1 days ago. The scenario is like this
- I contact him in "Discord" and we have the deal.
- Then, he requested me to join his discord group.
- Shady things is happening, I can't on "verification" bots (probably) his scam device (I can't be verified to join his group).
- Then, today my discord got hacked (I get kicked out on his discord group + he deleted all the chats).

He looking someone who are working in group. My advice don't apply on this.

Proof Picture, I'm joining with my dummy account for the proof:
1. His Discord Channel:


2. Link Verification going to MEE6 Fake (.app) domain:


3. I just check, the direction from the fake MEE6 to Discord, It's requested "Token" to bypass my account without 2FA:


The @OP of that hiring is also a wake up account could be a hacked account as well.

[1714222591]

1714222591

[1714222591]

1714222591

[saruc]

Mee6 can be hosted on your server. What happened to you is unfortunate but has nothing to do with us

[ryzaadit]

Mee6 can be hosted on your server. What happened to you is unfortunate but has nothing to do with us

It's clear on the discord you're referring people to the fake MEE6.

The official MEE6: https://mee6.xyz/ and your discord channel referred to fake MEE6 based on my post. I was hacked one day after contacting with you, and the only new activity is with you. You also deleted all the-chat and leave from the discord channel i was moderation.

[crwth]

Thank you for sharing this, OP. I didn't know that they could do that.

In my experience, I have verifications that doesn't lead to external websites. It's done everything in Discord. It's best to trust servers and others with verification modes to have that entire thing in Discord, and if it leads to a link, definitely a red flag already.

Might be a token or authorization thing from them and exploited something?

[ryzaadit]

Might be a token or authorization thing from them and exploited something?

If you look in the third post.

It's requested "token" for the the verification drag by his fake MEE6. That's why, even my account have 2FA it's useless because he overdrive my account using a token. During my hacked account, the password is not change at all.

Lesson learned by my self, it's my first time verification lead to website and I don't know.

[saruc]

Might be a token or authorization thing from them and exploited something?

If you look in the third post.

It's requested "token" for the the verification drag by his fake MEE6. That's why, even my account have 2FA it's useless because he overdrive my account using a token. During my hacked account, the password is not change at all.

Lesson learned by my self, it's my first time verification lead to website and I don't know.

If you have 2fa, the token authentification won't work! I found your discord from PM's.




No messages deleted from me, I am not in your server anymore for some reason! You deleted me from friends! When I saw you are not at friends anymore ,I thought you are angry on me not hiring you


Whoever hacked you did a great job

[saruc]

You deleted your own messages and closed the DM with me! It is the only explanation!

[ryzaadit]

-snip-

It's clear, you're invited to me into the discord channel you want to hiring.

Make a fake verification by based on the proof 3 image, I only warn people to not fall into the scam. The fake verification is hosted on you by redirected link on your discord channel giving to me one day after contacted with you.

All interacted before the hacked one days it's with you.

[saruc]

-snip-

It's clear, you're invited to me into the discord channel you want to hiring.

Make a fake verification by based on the proof 3 image, I only warn people to not fall into the scam. The fake verification is hosted on you by redirected link on your discord channel giving to me one day after contacted with you.

All interacted before the hacked one days it's with you.

YOU WERE NOT BLOCKED AND MY MESSAGES WERE NOT DELETED. WHY ARE YOU LYING?

[BitcoinGirl.Club]

-snip-

It's clear, you're invited to me into the discord channel you want to hiring.

Make a fake verification by based on the proof 3 image, I only warn people to not fall into the scam. The fake verification is hosted on you by redirected link on your discord channel giving to me one day after contacted with you.

All interacted before the hacked one days it's with you.

YOU WERE NOT BLOCKED AND MY MESSAGES WERE NOT DELETED. WHY ARE YOU LYING?

Gosh! Someone please tech me discord. One is saying he got scammed, his messages were deleted and another one is saying the messages were not deleted and he is lying. What to conclude when I don't have much idea about discord.

2. Link Verification going to MEE6 Fake (.app) domain:

Isn't it supposed to be a kind of CAPTCHA verification instead of taking to a new external URL?

[ryzaadit]

-snip-

You are just easily deleted all-the think for the conversation, with my account during the hack. The case is after contacted with you and the only direct message who are getting deleted is only a message with you.

It's clear just check your discord channel listed a fake "MEE6" link for verification based on picture number 2 and number 3 it's requested token ID.

-snip-

Well based on the instruction it's a captcha but to be verified he put a link for verification ask me to redirect link somewhere else, for prove me a human. There is no captcha number or letter, it's ask us to verified on website.

- Listed "URL" to somewhere else pretend for verification. The embed link post is real by MEE6 bots but the link redirect is fake MEE6.
- Pretended to be MEE6 by bookmarking the drag me (Verification) to my browser.
- Then the instruction is to go back into verification with discord browser, and click the link by bookmark.

You can verified MEE6 Official Link: https://mee6.xyz/en and on picture number 2 he put a fake MEE6 feel free to match the domain it's different. My bad not checking this, I check after discovering how my account getting hacked and after contact with him.

This is the fake MEE6 listed to be used for verification on his discord channel, verification is directing to web. As you can see the domain is not .xyz (official MEE6)

[BitcoinGirl.Club]

Well based on the instruction it's a captcha but to be verified he put a link for verification ask me to redirect link somewhere else, for prove me a human. There is no captcha number or letter, it's ask us to verified on website.

- Listed "URL" to somewhere else pretend for verification. The embed link post is real by MEE6 bots but the link redirect is fake MEE6.
- Pretended to be MEE6 by bookmarking the drag me (Verification) to my browser.
- Then the instruction is to go back into verification with discord browser, and click the link by bookmark.

You can verified MEE6 Official Link: https://mee6.xyz/en and on picture number 2 he put a fake MEE6 feel free to match the domain it's different. My bad not checking this, I check after discovering how my account getting hacked and after contact with him.

This is the fake MEE6 listed to be used for verification on his discord channel, verification is directing to web. As you can see the domain is not .xyz (official MEE6)

All clear, feels great that I don't need to be a discord expert to understand it now. It's a nice new method of phishing attach and working well for the scammer. What is he going to do with the discord account? I suspect he has bigger plan. What if he installed a keylogger and taking every keystrokes you are hitting?

I suggest you to install a fresh copy of the operating system or at least use a virus scanner and scan the device. Safe is to reinstall the operating system and start from a fresh system. If keylogger is installed then by now he already have a lot of details that you have entered in different sites. You may also want to change the account passwords once you have the fresh copy installed in the device.

I am going to tag the person.

Good luck brother

[ryzaadit]

What is he going to do with the discord account? I suspect he has bigger plan.

He created phishing link of my project (mint) and posted it on the discord channel I was the moderator. (I was admin/mod in one discord channel at the moment). IMO, he targeting the person who are currently working moderator on some project, to spread any phising fake project.

I suggest you to install a fresh copy of the operating system or at least use a virus scanner and scan the device. Safe is to reinstall the operating system and start from a fresh system. If keylogger is installed then by now he already have a lot of details that you have entered in different sites. You may also want to change the account passwords once you have the fresh copy installed in the device.

Thank you for the suggestion, and yes I checking everything right now for my discord account, channel I was moderated and my device.

[saruc]

ARE YOU BLIND? DON'T YOU SEE YOU DELETED YOUR MESSAGES AND REMOVED ME FROM FRIENDS? ARE YOU UPSET I DIDN'T HIRE YOU?

TOKEN DOESN'T BYPASS 2FA!!!!

MORE THAN 20 PEOPLE MESSAGED FROM BITCOINTALK ,NOBODY HAD A PROBLEM ONLY YOU

[ryzaadit]

ARE YOU BLIND? DON'T YOU SEE YOU DELETED YOUR MESSAGES AND REMOVED ME FROM FRIENDS? ARE YOU UPSET I DIDN'T HIRE YOU?

Who sad not being hired? I'm more sad for the people are falling a scam because your link phising posted with my account because you hacked it. I already respond about message deleted on previous post, no need to talk twice
---
Token ID Discord can bypass Email, 2FA, Password. You don't need all-of these things, If you have the token ID
- https://www.youtube.com/watch?v=xmCfUizcNLE
- https://www.reddit.com/r/discordapp/comments/nvuyj4/can_tokens_bypass_2fa_and_sms_auth_and_if_they/

That's why, you can login to my account but not changing the password. Because you have the token ID but don't have the password.

[holydarkness]

What is he going to do with the discord account? I suspect he has bigger plan.

He created phishing link of my project (mint) and posted it on the discord channel I was the moderator. (I was admin/mod in one discord channel at the moment). IMO, he targeting the person who are currently working moderator on some project, to spread any phising fake project.

Ahh, just like what I thought as the possible motive when I read the opening post. Anyway, have you regain full and sole access to the said account? If you want, I can join that channel you moderated and warned people to stay away and ignore any message from your discord account for the time being.

[2double0]

I was interested in applying for this job but was skeptical about this, because I saw that this user came online after a very long time of inactivity, so I decided not to go for this. And as discord hack stories were in the talks some time ago when I used to moderate some groups, I stopped taking any discord jobs and looked for telegram and other social media. Thank you for bringing this in front of us and stopping us from going for this.

[albon]

He asks to hire Moderators for $150/week to hack them on his Discord, it's regrettable, and it's good that you exposed him and exposed his method so that more victims' accounts are not hacked; the scam he did on Discord is not new, it's the verification bot in which the scammer manipulates to put a malicious link, so if the person checks the bot link before opening it, his account will not be hacked, and his token will not be withdrawn. It is worth noting that the scammer can create a bot similar to a popular bot on his server or a site similar to a popular bot site, such as MEE6 or CaptchaBot.. etc. Therefore, there are many scammers, so we must be careful before applying for a job with an unknown person with a small rank account.

[alterra57]

Was your Discord account your main one? If he has access to your main account it is good to contact (through another way) everyone before he does and let them know you got hacked. The scammer is a piece of shit and will probably hit everyone up with some scam.

[CryptSafe]

Wow! I almost applied for this job some days past but upon applying for it something happened that took my attention so I had to stop it and tried finishing up before I could apply. After I was done with it, I was very tired to pay attention to this application and was pushing it upwards until I lost interest in it not to come here to see a scam accusations against the account that made this post and offer. So if I had applied then would this have been my fate. What would I have said to myself if my account got Jack in the cause of doing a planned script hacking act.

My goodness thank you op for revealing this here. I think I made a you turn now not applying anymore and I checked again the account was flagged which is not a good sign.