The article is about using scripts to identify and download the malware. They identified over 1000 matching repos, which would contain Discord webhooks in the script.
Scanning and identifying has already been done. That’s literally what the article is about.
It’s right in the second paragraph:
> As soon as you download and launch any of these, all the data from your computer is collected and sent to some discord server
why don't we just send bad people to jail?
From the article:
> The "trust" value, when base64-decoded, turns out to be a discord webhook link: myhook = 'https://discord.com/api/webhooks/1050437982584324138/VJByvmB...'
Collect all the scripts matching the template. Extract the “trust” variable. Decode base64. Send to Discord with proof of how it was obtained.
Discord then identifies the Discords matching those webhooks.
It’s not some hard static analysis problem. These are python scripts with a base64 encoded variable. I don’t understand why you’re making it out to be something other than what the article says.
if it was that simple it would be a solved problem. i encourage you to give it a shot
