Rust‑Written CikaBika Trojan Hijacks Discord for Remote Control of Infected PCs

Security researchers at Darktrace have identified a fresh malware campaign that leverages a Rust‑based remote access trojan, dubbed CikaBika Bot, to transform the popular chat platform Discord into a covert command and control hub.

The infection chain begins with attackers distributing counterfeit documents that appear legitimate to unsuspecting Windows users. When a victim opens the attachment, the embedded payload installs the CikaBika binary, which runs silently in the background and establishes a foothold on the compromised system.

Unlike many traditional RATs that rely on custom servers, CikaBika exploits Discord’s public API together with Ngrok, a tunneling service that creates encrypted pathways to otherwise firewalled machines. By routing traffic through Discord channels and Ngrok tunnels, the malware can receive instructions, upload stolen data, and execute arbitrary commands without exposing a dedicated malicious server.

Once active, the trojan grants operators full visibility into the victim’s environment. It can capture screenshots, record keystrokes, list and exfiltrate files, and launch additional payloads. The use of Discord as a communication layer makes detection harder, as network traffic blends with ordinary chat traffic, and the encrypted Ngrok tunnels conceal the true destination of the data streams.

The choice of Rust for development reflects a broader shift among threat actors toward languages that produce small, efficient binaries and are harder for conventional antivirus engines to flag. Rust’s memory‑safety guarantees also reduce the risk of crashes that could alert users to the presence of malware. Meanwhile, the reliance on legitimate services such as Discord mirrors a growing trend where attackers co‑opt everyday platforms to evade security controls.

Cybersecurity experts advise users to treat unsolicited documents with suspicion, keep Windows and security software up to date, and monitor network activity for unusual connections to Discord or Ngrok endpoints. Organizations may also consider restricting outbound traffic to known Discord server addresses and employing deep‑packet inspection to identify anomalous tunneling behavior. As threat actors continue to weaponize mainstream tools, vigilance and layered defenses remain essential to mitigate the risk posed by sophisticated campaigns like the CikaBika Bot.