A Twitch embed in Discord could run malware with one click

A single click on a normal-looking Twitch embed gave an attacker a path to run arbitrary code on a Discord user's machine. That turns an ordinary clip link into a potential malware-delivery route inside private messages and large channels.

Discord confirmed the exploit and paid security researcher JayTaelien $5,500. The access enabled malware deployment, data theft, and broader machine compromise, with the victim's only required action being clicking the embed.