Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCikaBika Bot is a Rust-based Windows remote access trojan (RAT) that uses Discord as its command-and-control channel. A campaign documented by Darktrace on October 14, 2026, starts with a document-themed disk image, hides execution behind a decoy PDF, and uses a Nim loader, PowerShell and DLL search-order hijacking to load the malware. Once active, CikaBika inventories the computer, registers it to a dedicated Discord channel and gives operators interactive control over commands, screenshots and file transfers.
What CikaBika Bot is
CikaBika Bot is not a Discord feature or a legitimate automation bot. It is malware for Windows. Discord serves as the control channel, allowing an operator to communicate with each infected computer through a server channel rather than maintaining a conventional, dedicated command server. Darktrace describes this model as attractive because a communications platform can provide attackers with a ready-made C2 channel.
As an Amazon Associate I earn from qualifying purchases.
The available reporting documents the malware’s behavior and capabilities, but does not establish a named threat actor, victim count, geographic scope or total campaign size.
How the Windows infection unfolds
1. A disk image presents a document lure
The observed file is a disk image named Proposition_Projet.img. It contains a French-language PDF presented as the legitimate document and an LNK shortcut whose name is made to resemble a Microsoft Word document. The combination is intended to make the user open the shortcut while believing they are opening an office file.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
2. The shortcut opens the decoy and starts hidden PowerShell
Opening the LNK displays the decoy PDF but also launches PowerShell without an obvious console window. The script decodes an executable embedded in the shortcut’s delivery chain and runs it. The visible document therefore acts as cover for the second-stage execution.
3. A Nim loader deploys the Rust payload
The decoded executable is a Nim-based loader. It contains both the Rust DLL that provides the RAT functionality and a PowerShell deployment script. The loader attempts to place a malicious dbghelp.dll in the Microsoft Edge application directory.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
4. UAC bypass and DLL search-order hijacking load the RAT
The deployment uses a PowerShell registry-based UAC-bypass technique and DLL search-order hijacking. When Edge loads libraries, the planted dbghelp.dll is selected in place of the expected library, causing the Rust payload to run inside the application context. The reports establish this hijacking location and loading method; they do not establish a separate, guaranteed persistence mechanism such as a scheduled task or service.
What CikaBika does after loading
Before an operator starts issuing commands, the RAT performs reconnaissance and registers the host with Discord. The registration record includes:
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
- A device identifier and hostname
- The registration time and current status
- Private and public IP addresses
- System uptime
- An assigned Discord channel
Each victim receives a dedicated channel, giving the operator a separate control space for that device. Darktrace observed commands equivalent to tasklist for process enumeration and ipconfig for network configuration, along with a public-IP lookup through ipify.com and screenshot capture.
Commands and surveillance capabilities
The following command names were reported in CikaBika strings and handlers. Their presence shows the intended interface; the report does not say that every listed function was exercised in every infection.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
| Command | Reported function |
|---|---|
!shell |
Execute shell commands on the victim |
!sysinfo |
Return system information |
!info |
Return host or implant details |
!isOn |
Check whether the implant is active |
!tasklist |
Enumerate running processes |
!ps |
Run PowerShell-related activity |
!kill |
Terminate a process |
!upload |
Send a file from the victim to the operator |
!download |
Request a file for delivery to the victim |
!src |
Handler references for screenshots and additional camera, streaming or broadcasting functions |
Screenshot capture was observed as part of reconnaissance. The camera, streaming and broadcasting references appear in the malware’s strings or handlers, so they should be treated as available surveillance paths rather than proof that each was used during the documented activity.
How files leave the victim
CikaBika can upload and download files through its Discord-controlled interface. In the observed activity, an operator used PowerShell to compress a directory into a ZIP archive and then exfiltrated the archive through Ngrok. This creates a useful sequence for defenders to investigate: archive creation, followed by an Ngrok connection and Discord-related control traffic.
Best Value
![Malwarebytes Standard, Premium Security| Amazon Exclusive | 18 Months, 2 Devices | Windows, Mac OS, Android, Apple iOS, Chrome [Online Code]](https://m.media-amazon.com/images/I/41LbYnawq9L._SL160_.jpg)
- AWARD WINNING Antivirus, anti-malware, anti-spyware & more
- 24/7 REAL TIME PROTECTION against emerging malware threats, including ransomware and viruses- without slowing you down.
- PROTECTS YOUR DEVICES ON MULTIPLE PLATFORMS: Get cyber protection for your computers, smartphones, or tablets- Compatible with Windows, Mac, Android, iOS
- DOWNLOAD AND INSTALL INSTANTLY
- UNMATCHED THREAT DETECTION: We found malware on 40 percent of devices that already had a third-party antivirus installed.
Detection and hunting priorities
The documented behaviors provide practical pivots for endpoint, identity and network investigations. They are hunting ideas, not claims that a particular security product detected the sample.
- Delivery: Look for document-themed disk images, especially images containing both a decoy PDF and an LNK shortcut with a Word-like name.
- PowerShell: Investigate hidden or non-interactive PowerShell launched at the same time a decoy document opens. Review encoded or embedded executable-decoding behavior.
- DLL hijacking: Check the Microsoft Edge application directory for an unexpected
dbghelp.dlland examine which process loaded it. - Privilege escalation: Correlate suspicious registry changes associated with a PowerShell UAC-bypass attempt with subsequent Edge launches.
- Discord C2: Flag Discord network activity initiated by processes that are not the approved Discord client or browser workflow. Look for per-host registration patterns and newly created, device-specific channels.
- Reconnaissance: Correlate process enumeration,
ipconfig, screenshot activity and public-IP lookups occurring soon after a suspicious PowerShell chain. - Exfiltration: Search for ZIP creation followed by Ngrok traffic, especially when the archive operation was launched from PowerShell or another unexpected process.
What defenders should not assume
A Discord connection alone is not proof of CikaBika infection: Discord is widely used for legitimate communication, and the available reporting does not publish fixed domains, hashes or a complete list of infrastructure indicators. Likewise, a suspicious dbghelp.dll must be investigated in context, because legitimate software can ship DLLs with the same filename. The strongest signal is the chain of behaviors—document-image delivery, hidden PowerShell, Edge-directory DLL loading, host registration and Discord-controlled activity—rather than any single artifact.
Why the campaign matters
CikaBika combines familiar Windows abuse techniques with an ordinary collaboration platform. The lure disguises an LNK as a document, PowerShell handles decoding and deployment, a registry UAC bypass and DLL search-order hijacking help load the payload, and Discord supplies interactive control. That combination can blend into normal user activity more easily than a plainly exposed custom command server, while still giving an operator reconnaissance, surveillance, process control and file-transfer functions.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
