Is Extrator de token • Ace Bot safe?

Q: Is Extrator de token • Ace Bot safe?

Extrator de token • Ace Bot is high risk. Code analysis shows this extension reads the Authorization header off every discord.com request, stores your full Discord session token in local storage, and shows it in the popup for you to copy into a third-party bot service.

High risk

Extrator de token • Ace Bot captures the user's Discord session token and displays it for hand-off to the third-party "Ace Bots" service.

The extension hooks Discord's network requests to read the Authorization header (the user's full Discord login token) from both outgoing requests and responses, and also pulls it directly out of Discord's own page code as a fallback. It actively forces a Discord API call in the background a few seconds after any Discord tab loads, guaranteeing a token is captured even if the user does nothing. The captured token is stored in the extension's local storage and shown in plaintext in the popup with a copy button, matching its stated purpose of obtaining a token to use with the third-party "Ace Bots" service named in the store listing.

v1.0.0Chrome Web Store

77Risk

Who publishes it

No other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Website

acebot.vip/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension captures your Discord session token and forces a request to get it

CriticalunwantedCWE-522Static analysis

Code analysis shows this extension reads the Authorization header off every discord.com request, stores your full Discord session token in local storage, and shows it in the popup for you to copy into a third-party bot service.

What actually happens

You did this

You open or reload discord.com while logged in.

No click on the extension itself is required.

The extension did this

The extension reads the Authorization header off that request, then forces its own request two seconds later to guarantee one fires.

Both the background service worker and a page-level content script capture the header independently.

What gets captured and stored

Your Discord session token
MTA1MjM0NTY3ODkwMTIzNDU2.G1a2Bc.dEfGhIjKlMnOpQrStUvWxYz012345
A full login credential. Anyone who has it can access your Discord account without your password or two-factor code.
Capture timestamp
1758262845000
When the token was captured, stored right alongside it.
Where it's kept
chrome.storage.local key 'discord_token'; localStorage key 'captured_discord_token'
The token sits in both the extension's own storage and the Discord page's browser storage, in plaintext.

The code that does this

The capture logic, shipped source versus an annotated read of it

Readable version

Show shipped source

Every outgoing/incoming Discord API call is watched for the Authorization header

// Fires on every request to discord.com/api/* or *.discord.com/api/*chrome.webRequest.onBeforeSendHeaders.addListener(  (details) => {    for (const header of details.requestHeaders ?? []) {      if (header.name.toLowerCase() === 'authorization' && header.value) {        // header.value IS the user's Discord session token        chrome.storage.local.set({          discord_token: header.value,          captured_at: Date.now(),        });      }    }  },  { urls: ['*://discord.com/api/*', '*://*.discord.com/api/*'] },  ['requestHeaders'],);

If the user just sits on the page without triggering a fresh API call, the extension makes one for them

// Runs 2 seconds after any discord.com tab finishes loadingchrome.scripting.executeScript({  target: { tabId },  function: () => {    // This request's Authorization header is what the listener above captures    fetch('https://discord.com/api/v9/users/@me', { credentials: 'include' });  },});

The page's own fetch/XHR calls are monkey-patched so the header is caught even without the network listener

// window.fetch is replaced; any call to discord.com/api/* is inspected// for an Authorization header on the way out, and the response headers// are checked for one on the way backwindow.fetch = function (url, options) {  if (url.includes('discord.com/api') && options?.headers) {    const auth = options.headers['authorization'] ?? options.headers.get?.('authorization');    if (auth) storeToken(auth); // saved to localStorage as captured_discord_token  }  return originalFetch(url, options);};

As a last resort, the token is read directly out of Discord's own client-side module registry

// Discord's web client keeps a getToken() export inside its own webpack// module registry. If no network request has fired yet, the extension// walks that registry and calls getToken() itself.if (window.webpackChunkdiscord_app) {  const req = window.webpackChunkdiscord_app.push([[Symbol()], {}, (r) => r]);  for (const id in req.c) {    const token = req.c[id].exports?.default?.getToken?.() ?? req.c[id].exports?.getToken?.();    if (token) storeToken(token);  }}

Check if you're affected

Checks this page's own local storage for a Discord token the extension has already captured, so you can see the capture for yourself without installing anything else.

Requires

Chrome or another Chromium browser
The extension installed and discord.com open in the active tab

check-captured-token.js · js

// check-captured-token.js// Run in the DevTools console on a discord.com tab to check whether// this extension has written a captured token into page storage.(function () {  const KEYS = ['captured_discord_token', 'token', 'auth', 'discord_token', 'user_token'];  let found = false;  for (const key of KEYS) {    const value = localStorage.getItem(key);    if (value && value !== 'undefined' && value !== 'null') {      console.log(`[CHECK] localStorage['${key}'] =`, value);      found = true;    }  }  if (!found) {    console.log('[CHECK] No captured token found in localStorage under the known keys.');  }  console.log('[CHECK] Note: chrome.storage.local (used by the extension\'s own background worker) is not readable from this page context; inspect it via chrome://extensions > Inspect views > background page.');})();

How to run it

1Install the extension and log into discord.com.
2Open DevTools (F12) on the discord.com tab.
3Paste this into the Console and press Enter.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Extrator de token • Ace Bot contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

Ace Bots (third-party service named in the listing)
Extrator de token • Ace Bot sends data to Ace Bots (third-party service named in the listing). Named as a recipient in this extension's own analysis.