Skip to main content

Slack & Discord Webhook Security: The Phishing Backdoor

It's Just a URL, Right?​

Developers often treat Webhook URLs (like hooks.slack.com/...) as harmless configuration strings. They paste them into public scripts, share them in tickets, or commit them to repositories.

The reality is that a Webhook URL is a Bearer Token. Anyone who possesses the URL can post messages to your internal chat channels.

The Attack Vector: Internal Phishing​

If an attacker finds a leaked webhook for your #engineering or #announcements channel, they don't need to hack your email server to launch a phishing attack.

  1. The Setup: The attacker sends a POST request to the webhook.
  2. The Payload: They craft a message that looks like an official IT alert: "URGENT: VPN Certificate Expired. Click here to renew."
  3. The Impact: Because the message appears inside your internal Slack/Discord—a trusted environment—employees are significantly more likely to click the malicious link.

Discord Risks​

For Discord, the risk extends to community management. A leaked webhook allows attackers to post scams (e.g., "Free Crypto Airdrop") to your community announcements channel, destroying your project's reputation instantly.

Detection Signatures​

These URLs have very specific structures that are easy to detect with static analysis.

Slack: https://hooks.slack.com/services/T[...]/B[...]/[...

Discord: https://discord.com/api/webhooks/[ID]/[TOKEN]

Defense Strategy​

  1. Treat URLs as Secrets: Store webhooks in your secrets manager (Vault, AWS Secrets Manager), not in code.
  2. Scanning:

Veritensor includes specific regex patterns to detect these URLs in your codebase, logs, and Jupyter notebooks.

# Veritensor detects this pattern
- "regex:https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}"

If a webhook is leaked, delete it immediately and generate a new one.