An investigation has uncovered that the main.py file in the Hawkish-Eyes repository injects malicious nodejs code into the Discord %APPDATA%/Discord/app-(versions)/modules/discord_desktop_core/index.js module. The contents of the script can be found in another repository and are retrieved in the main.py file (see link).
The index.js file, which is executed by the main thread of Electron (Discord), is responsible for stealing the Discord session token and collecting various information about the victim. The attacker receives this information, but a copy is also sent to https://panel.sordeal.com:3000/ using a POST method (see link).
A review of the code link reveals that we send the same HTTP request 2 times, one time for config.webhook and one time for config.Placed who is the dualhook url who is Encoded.
Hawkish Eyes v7
Proofs that Hawkish-Eyes Stealer is a Dual Hook
The index.js file, which is executed by the main thread of Electron (Discord), is responsible for stealing the Discord session token and collecting various information about the victim. The attacker receives this information, but a copy is also sent to https://panel.sordeal.com:3000/ using a POST method (see link).
A review of the code link reveals that we send the same HTTP request 2 times, one time for config.webhook and one time for config.Placed who is the dualhook url who is Encoded.
Hawkish Eyes v7
Proofs that Hawkish-Eyes Stealer is a Dual Hook