A trusted bot started spamming your Discord server? Use this incident checklist to contain the bot, audit roles, warn members and report it to Discord.
Contain the bot first: remove it from the server or strip its roles so it cannot post. Then delete the spam, warn members not to click the links, audit roles and webhooks, and report the messages to Discord. Discord's scam guidance says to give bots only the permissions they need. Re-add it only after its developer confirms a fix.
SummaryA bot you have trusted for months suddenly starts posting invite links and fake offers across your Discord server. Members are pinging you, some have already clicked, and the bot has more power than any of your moderators. You did not change anything. The bot itself, or the service behind it, has been taken over. This is a server incident, and the order you act in decides how much harm it does.
This guide uses Discord's own pages: Protecting Against Scams on Discord, the Community Guidelines, and the developer documentation on permissions and OAuth2. We also cite Cybernews on 8 October 2026. One wrong step can cost you the account, so know what you are doing before you start.
Last checked: 30 October 2026.
A bot acts on your server through a token that its developer holds. If that token is stolen, whoever has it can make the bot do anything its roles allow, in every server where it is installed. Your own account and password are not involved. That is why a bot with broad permissions is a bigger risk than a bot that can only do one job.
Cybernews reported on 8 October 2026 that Double Counter, a verification and anti-alt account service used by Discord communities, said a breach on 4 October exposed data tied to about 28 million Discord accounts, and that the attacker used a stolen bot token to post spam invites in about 50 large Discord communities. We take these figures from the report. Discord did not publish them on the pages we cite.
| Step | Action | Why |
|---|---|---|
| 1. Contain | Remove the bot from the server, or take away its roles so it cannot post | Stops new spam at once |
| 2. Lock channels | Pause posting in busy channels for a short time if spam is still landing | Gives moderators time |
| 3. Clean up | Delete the spam messages and any webhooks or invites you did not create | Removes the links members could still click |
| 4. Warn members | Post a short notice that the links were not from you and should not be clicked | Limits harm from what was seen |
| 5. Audit roles | Check who and what holds admin and other powerful permissions | Discord's guidance asks owners to audit permissions |
| 6. Report | Report the spam messages and any scam accounts to Discord | Creates a record with Discord |
| 7. Review the bot | Check the bot developer's own notices before adding it back | The token must be replaced on their side |
Discord's scam guidance asks server owners and moderators to audit their server permissions, especially for higher-level tools like webhooks, and to make sure only moderators you trust can change powerful server tools, including bots or webhooks. It says to give a bot only the permissions needed for its tasks and no more, to look for a Verified checkmark on a well-known bot, and to watch for bots impersonating larger well-known bots. It adds that in almost every case, a large and reputable moderation bot will never need admin permissions to work properly.
The permissions documentation explains why this matters. It lists the Administrator permission as one that allows all permissions. It also says a bot can only kick, ban and edit nicknames for users whose highest role is lower than the bot's highest role, and can only grant permissions it has. So keep bot roles below your moderators, and give a bot a role that matches its job.
Bots join servers through Discord's OAuth2 flow. The OAuth2 documentation says the bot scope puts the bot in the user's selected server, and that the authorisation page lists the permissions requested. Read that list before you approve. If a bot asks for more than its job needs, untick what you can, or choose a different bot. Wait until the developer says the stolen token has been replaced, because adding the same bot with the same compromised token brings the spam back.
Members who clicked a spam link may have landed on a fake login page or a QR code login prompt. Discord's scam guidance tells everyone not to click suspicious links, not to give their password to anyone, never to share or screenshare their authorisation token, and not to scan QR codes from people they cannot verify. Share that advice in your notice. Point anyone who scanned a code to our guide on a Discord QR code login scam, and anyone whose account is now sending scam messages to our guide on a Discord account hacked by a Nitro scam.
Before you delete everything, capture what happened. Screenshot a few of the spam messages with their timestamps, note the links and invite codes they used, and write down when the spam started and when you stopped it. If your server has an audit log and a moderator with permission to view it, export or screenshot the entries for the bot and any webhooks or invites created in that window. This record helps your report to Discord, helps you answer members who ask what happened, and helps the bot developer if they ask for details. Keep it somewhere outside Discord.
The Community Guidelines say not to send unsolicited bulk messages, or spam, and not to facilitate it, for example by selling spambots or token generators. They also prohibit phishing and the use of Discord to run financial scams. Your server did not break these rules by being targeted, but reporting the spam helps Discord act on the accounts and links behind it.
Malaysian gaming, esports and study servers rely on verification and moderation bots just like servers elsewhere. Agree in advance who has the power to remove a bot in an emergency, so you are not waiting for the one owner who is asleep. Keep that person's account protected with two-factor authentication and backup codes stored offline.
Some owners handle this alone, and the checklist above comes first. The risks are real. Webhooks and invites created by the attacker can stay behind after the bot is removed. A moderator account taken over through a spam link can keep the attack going from inside. If your server is large, tied to your business or brand, or you cannot tell what the bot changed, having an experienced team handle it is the safer choice. AwareXone does this work. See our account security page.
A case review helps when a moderator or owner account was also taken, when you are unsure which permissions to keep, or when members report losses. We are a Malaysia-based team, independent of Discord, and we work through the official routes only. We never ask for your password, codes or tokens, and we cannot promise a result. Read how we work on our trust page.
More free guides on the same kind of problem.
