New Discord Phishing Kit: "Nexora.gl" (MrBeast Impersonation) - Token Stealer Analysis

I’ve identified a new phishing domain nexora[.]gl currently being pushed through Discord DMs and server "announcements." It is a sophisticated impersonation of a MrBeast giveaway or project portal. This site is a direct clone of the older maonax[.]com kit, if any of you are familiar with it.

framework: built with next.js

The mechanism:

The site uses obfuscated JavaScript (found in inspect element -> source: /_next/static/chunks) to scrape the browser's localstorage

The goal:

It is a Session Hacker. It targets the Discord token to bypass 2FA. Once the attacker has this, they take full control of the account without needing a password.

Crypto connection:

This kit is often used as a front for Crypto Drainers. They may ask you to "link your wallet" to claim a prize, which then triggers a malicious contract to empty your funds.

Domain info:

URL: nexora[.]gl

Nameservers: matteo.ns.cloudflare.com / nataly.ns.cloudflare.com

Registry: NIC.gl (Reported)

What to do:

If you or a friend visited this site, do not just change your password. Go to Discord Settings > Devices and click "log out all the known devices" This is the only way to kill the stolen session token.

unfortunately since I don't have the permission to upload the image of the website i can't show it.