# Discord Server Spammed by a Hacked Bot: What to Do > A trusted bot started spamming your Discord server? Use this incident checklist to contain the bot, audit roles, warn members and report it to Discord. - URL: https://www.awarexone.com/research/discord-server-spammed-by-compromised-bot-what-to-do - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-30 - Topics: Discord, Server security, Bots - Related service: Account security: https://www.awarexone.com/services/account-security ## Short answer Contain the bot first: remove it from the server or strip its roles so it cannot post. Then delete the spam, warn members not to click the links, audit roles and webhooks, and report the messages to Discord. Discord's scam guidance says to give bots only the permissions they need. Re-add it only after its developer confirms a fix. ## Summary - When a bot you added starts posting scam links, treat it as a security incident: contain the bot first, then clean up and warn members. - Cybernews reported on 8 October 2026 that an attacker used a stolen bot token from the Double Counter service to post spam invites in large communities. - Discord's scam guidance says to give a bot only the permissions it needs, and that a large reputable moderation bot will never need admin permissions. - Audit roles and webhooks before you add the bot back. One wrong step can cost you the account, so know what you are doing before you start. A bot you have trusted for months suddenly starts posting invite links and fake offers across your Discord server. Members are pinging you, some have already clicked, and the bot has more power than any of your moderators. You did not change anything. The bot itself, or the service behind it, has been taken over. This is a server incident, and the order you act in decides how much harm it does. This guide uses Discord's own pages: [Protecting Against Scams on Discord](https://discord.com/safety/protecting-users-from-scams-on-discord), the [Community Guidelines](https://discord.com/guidelines), and the developer documentation on [permissions](https://discord.com/developers/docs/topics/permissions) and [OAuth2](https://discord.com/developers/docs/topics/oauth2). We also cite [Cybernews on 8 October 2026](https://cybernews.com/security/discord-user-data-breach/). One wrong step can cost you the account, so know what you are doing before you start. Last checked: 30 October 2026. ## What Happens When a Discord Bot Is Compromised? A bot acts on your server through a token that its developer holds. If that token is stolen, whoever has it can make the bot do anything its roles allow, in every server where it is installed. Your own account and password are not involved. That is why a bot with broad permissions is a bigger risk than a bot that can only do one job. [Cybernews reported on 8 October 2026](https://cybernews.com/security/discord-user-data-breach/) that Double Counter, a verification and anti-alt account service used by Discord communities, said a breach on 4 October exposed data tied to about 28 million Discord accounts, and that the attacker used a stolen bot token to post spam invites in about 50 large Discord communities. We take these figures from the report. Discord did not publish them on the pages we cite. ## The Incident Checklist *Our checklist, built on Discord's scam guidance and permission docs.* | Step | Action | Why | | --- | --- | --- | | 1. Contain | Remove the bot from the server, or take away its roles so it cannot post | Stops new spam at once | | 2. Lock channels | Pause posting in busy channels for a short time if spam is still landing | Gives moderators time | | 3. Clean up | Delete the spam messages and any webhooks or invites you did not create | Removes the links members could still click | | 4. Warn members | Post a short notice that the links were not from you and should not be clicked | Limits harm from what was seen | | 5. Audit roles | Check who and what holds admin and other powerful permissions | Discord's guidance asks owners to audit permissions | | 6. Report | Report the spam messages and any scam accounts to Discord | Creates a record with Discord | | 7. Review the bot | Check the bot developer's own notices before adding it back | The token must be replaced on their side | ## Audit Roles and Bot Permissions Discord's [scam guidance](https://discord.com/safety/protecting-users-from-scams-on-discord) asks server owners and moderators to audit their server permissions, especially for higher-level tools like webhooks, and to make sure only moderators you trust can change powerful server tools, including bots or webhooks. It says to give a bot only the permissions needed for its tasks and no more, to look for a Verified checkmark on a well-known bot, and to watch for bots impersonating larger well-known bots. It adds that in almost every case, a large and reputable moderation bot will never need admin permissions to work properly. The [permissions](https://discord.com/developers/docs/topics/permissions) documentation explains why this matters. It lists the Administrator permission as one that allows all permissions. It also says a bot can only kick, ban and edit nicknames for users whose highest role is lower than the bot's highest role, and can only grant permissions it has. So keep bot roles below your moderators, and give a bot a role that matches its job. - List every bot and webhook on the server and remove those you no longer use. - Take Administrator away from any bot that does not truly need it. - Move bot roles below your moderator roles. - Check that only trusted moderators can manage webhooks, roles and integrations. - Make sure every moderator has two-factor authentication on, as Discord's guidance advises for everyone. ## When You Add a Bot Again Bots join servers through Discord's OAuth2 flow. The [OAuth2](https://discord.com/developers/docs/topics/oauth2) documentation says the bot scope puts the bot in the user's selected server, and that the authorisation page lists the permissions requested. Read that list before you approve. If a bot asks for more than its job needs, untick what you can, or choose a different bot. Wait until the developer says the stolen token has been replaced, because adding the same bot with the same compromised token brings the spam back. ## Protect Members Who Clicked Members who clicked a spam link may have landed on a fake login page or a QR code login prompt. Discord's [scam guidance](https://discord.com/safety/protecting-users-from-scams-on-discord) tells everyone not to click suspicious links, not to give their password to anyone, never to share or screenshare their authorisation token, and not to scan QR codes from people they cannot verify. Share that advice in your notice. Point anyone who scanned a code to our guide on a [Discord QR code login scam](https://www.awarexone.com/research/discord-qr-code-login-scam-scanned), and anyone whose account is now sending scam messages to our guide on a [Discord account hacked by a Nitro scam](https://www.awarexone.com/research/discord-account-hacked-nitro-scam). ## Keep a Record of the Incident Before you delete everything, capture what happened. Screenshot a few of the spam messages with their timestamps, note the links and invite codes they used, and write down when the spam started and when you stopped it. If your server has an audit log and a moderator with permission to view it, export or screenshot the entries for the bot and any webhooks or invites created in that window. This record helps your report to Discord, helps you answer members who ask what happened, and helps the bot developer if they ask for details. Keep it somewhere outside Discord. ## What Discord's Rules Say About Spam The [Community Guidelines](https://discord.com/guidelines) say not to send unsolicited bulk messages, or spam, and not to facilitate it, for example by selling spambots or token generators. They also prohibit phishing and the use of Discord to run financial scams. Your server did not break these rules by being targeted, but reporting the spam helps Discord act on the accounts and links behind it. ## For Malaysian Gaming and Community Servers Malaysian gaming, esports and study servers rely on verification and moderation bots just like servers elsewhere. Agree in advance who has the power to remove a bot in an emergency, so you are not waiting for the one owner who is asleep. Keep that person's account protected with two-factor authentication and backup codes stored offline. ## When It Is Safer to Get Expert Help > Warning: **Before you act alone.** Adding a compromised bot back too soon, or leaving admin rights on the wrong role, can hand an attacker your server a second time. Some owners handle this alone, and the checklist above comes first. The risks are real. Webhooks and invites created by the attacker can stay behind after the bot is removed. A moderator account taken over through a spam link can keep the attack going from inside. If your server is large, tied to your business or brand, or you cannot tell what the bot changed, having an experienced team handle it is the safer choice. AwareXone does this work. See our [account security](https://www.awarexone.com/services/account-security) page. ## When a Case Review Makes Sense A case review helps when a moderator or owner account was also taken, when you are unsure which permissions to keep, or when members report losses. We are a Malaysia-based team, independent of Discord, and we work through the official routes only. We never ask for your password, codes or tokens, and we cannot promise a result. Read how we work on our [trust page](https://www.awarexone.com/trust). ## Frequently Asked Questions ### Was my server hacked if a bot posted spam? Not in the usual sense. The bot's token was likely stolen from its developer. Your account and server settings may be unchanged, but check roles and webhooks. ### Should I remove the bot or just its roles? Either stops the spam. Removing it is the cleaner choice until its developer confirms a fix. ### Does a moderation bot need Administrator? Discord's scam guidance says a large reputable moderation bot will never need admin permissions to work properly in almost every case. ### What should members do if they clicked? Not enter passwords or scan QR codes from the link, change their password if they did, and turn on two-factor authentication. ### Can AwareXone help secure my server? We can review roles, bots and moderator accounts with you and help with reports to Discord. Discord decides any action on its side. ## Official sources - [Official: Protecting Against Scams on Discord (read 30 October 2026)](https://discord.com/safety/protecting-users-from-scams-on-discord) - [Official: Permissions, Documentation, Discord (read 30 October 2026)](https://discord.com/developers/docs/topics/permissions) - [Official: OAuth2, Documentation, Discord (read 30 October 2026)](https://discord.com/developers/docs/topics/oauth2) - [Official: Community Guidelines | Discord (read 30 October 2026)](https://discord.com/guidelines) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.