Hey there,
Yesterday I got hacked somehow, and while researching what happened I found this post:
https://www.reddit.com/r/discordhelp/comments/1rp3e54/discord_account_hacked_email_changed_hacker/
It explains almost everything except one thing. My email account was never accessed (I checked the login history), but my Discord email and password were changed, and a new MFA method was added to the account.
I was suddenly logged out of Discord while using my PC. I didn't click any suspicious links, didn't scan any QR codes, and didn't enter my credentials anywhere unusual.
Discord support managed to help me restore the email back to mine, but I'm still trying to understand how this happened.
From what I read, people mention stolen Discord tokens, but I'm confused about how that would allow someone to change the email without accessing my email?
Could this really happen through a stolen session/token, or is there another method attackers use?
I would really appreciate any technical explanation because I want to understand what happened and make sure it doesn't happen again.