The infinity kingdom discord scam is a social engineering attack where strangers contact gamers through fake “accidental” friend requests on Discord. They spend up to 24 hours building a fake friendship, then send a malicious app link disguised as the real Infinity Kingdom game. The installed app contains a Remote Access Tool (RAT) that can steal your passwords, two-factor authentication codes, and device access. If you got this DM: block and report right now. If you already downloaded the app: factory reset your device.
Someone just sent you a Discord DM out of nowhere. They said they added you by mistake. Now they want you to try a mobile game called Infinity Kingdom. You searched the name, and “scam” showed up in the autocomplete suggestions. Your gut is right.
The infinity kingdom discord scam is real. It has caught thousands of gamers off guard, and it is spreading fast across popular gaming servers in 2025 and 2026. This article explains exactly how the scam works at each stage, what the warning signs look like, and what steps to take based on how far your conversation went.
Is the Infinity Kingdom Discord Scam Real?
Yes. The infinity kingdom discord scam is a documented and organized social engineering attack. It targets active gamers across Discord servers of all sizes.
Infinity Kingdom itself is not a scam. It is a real mobile MMO strategy game made by YOOZOO Singapore, also published under GTarcade. The scammers have no connection to the game developers. They simply use the game name as a cover.
The people running this scam have two main goals:
- Malware installation: They get you to download a modified version of the Infinity Kingdom app. That app contains a Remote Access Tool (RAT) that quietly runs in the background and gives them access to your device.
- Financial pressure: They get you inside the game, build on the fake friendship they already started, and push you to spend real money through in-game purchases or fake payment websites.
Both can happen at the same time. This is not one person working alone. These are organized groups running the same script across hundreds of gaming community Discord servers at once.
According to Discord’s 2026 Transparency Report, the platform took action on more than 3 million accounts for deceptive practices between March 2025 and March 2026. That number includes phishing Discord activity, malware distribution, credential theft, and financial fraud. The infinity kingdom discord scam bot network is part of that wider problem.
How Does the Infinity Kingdom Discord Scam Work?
The scam follows a planned five-stage process. It starts with a fake “accidental” friend request, moves through roughly 24 hours of friendly chat, and ends with either a dangerous app download link or pressure to spend money inside the game. The patience is deliberate. A full day of conversation makes the download request feel like helping a friend, not a risk.
Stage 1: The Accidental Contact
The scammer sends you a Discord direct message (DM) that says something like this: “Hey, are you [Name] from the [Game] team? Sorry, I think I added the wrong person.”
When you tell them they have the wrong person, a real stranger would apologize and stop messaging. This person stays. They use your response as a doorway into a longer conversation: “Oh, you play games too? Since we are both gamers, want to chat?”
This opener is always scripted. It is designed to seem harmless and give the scammer a believable reason to keep talking to you. This is the first stage of the discord scam fake friend request cycle.
Stage 2: Building the Fake Friendship
After the first message, the scammer spends hours, and sometimes a full day, in friendly conversation. They ask what you are cooking. They ask what games you enjoy. They share photos of food or their “daily life.”
They almost always use the same persona:
- Age: 23 to 28 years old
- Location: Hong Kong, Singapore, or Malaysia
- Photos: An anime-style or AI-generated image of a young woman
- Common screen names: Sylvia, Janice, Sharon_xl, Philyy.45 (these change often as accounts get banned)
This stage works because of a real psychological principle called reciprocity. When someone spends time on you, you naturally feel a pull to return the favour. That pull is exactly what the scammer is building.
One development spotted in 2026: some scammers now use AI-generated voice notes to make their persona sound more convincing. This was first reported in Steam community forums in April 2026. If someone in a Discord DM sends voice notes that feel slightly “off” or robotic, this may be the reason.
Stage 3: The Invitation
Once the scammer believes you trust them, they bring up the game. Their alliance needs one more member. It will only take five minutes to set up. They will wait for you.
The social pull built in Stage 2 is what makes Stage 3 feel natural. You feel like you would be letting down a new friend, not a stranger running a script.
Stage 4: The Dangerous Download Link
This is the most dangerous stage of the discord gaming scam fake friend setup.
Instead of pointing you to the Google Play Store or Apple App Store, the scammer sends you a private link. They may describe it as a “regional build,” a “special version,” or claim it downloads faster than the app store version.
That link leads to a malicious APK, which is an app file that bypasses the official stores entirely. Once installed, the app looks and plays exactly like the real Infinity Kingdom. It connects to the real game servers. You would have no idea anything was wrong.
But a Remote Access Tool is running silently in the background. It gives the scammer access to your device without any sign on your screen.
| Feature | Official App Store | Scammer-Provided Link |
| Source | Google or Apple servers | Third-party file or cracked APK |
| Security check | Scanned by the platform | Contains a hidden Remote Access Tool |
| Payments | Secured by Google or Apple | Fake sites steal your card details |
| Updates | Automatic and verified | Manual, may push more malware later |
| Appearance | Identical to scammer version | Identical to official version |
Never download any app from a link sent to you in a private Discord message. If the game is real, it is on the official app stores.
Stage 5: Financial Pressure and Abuse
Once you are inside the game, the pressure begins. Your new “friend” tells you the alliance needs you to buy a bundle to help in an upcoming battle. It usually starts small, under one dollar. Then it climbs to tens or even hundreds of dollars.
Sometimes the scammer directs you to an outside payment website, claiming the in-game store is not working. That site is built to steal your credit card details outright.
If you refuse or question them, the tone often changes quickly. Many victims report the scammer switching to insults or aggression. That shift reveals what the “friendship” actually was.
Who Gets Targeted and How Scammers Find You
Scammers do not choose people randomly. They browse member lists of large gaming Discord servers. They look for accounts that seem active, with a profile picture, a custom status message, or signs of recent participation. Any of those signals marks you as a usable target.
Discord has around 90 million daily active users. Popular gaming community Discord servers for titles like Valorant, Genshin Impact, Dark Souls, Skyrim, and Minecraft contain hundreds of thousands of members. Scammers can scroll through those lists without you knowing.
According to a June 2025 investigation by Check Point Research, attackers compromised over 1,300 users across eight countries by targeting gamers directly through Discord channels.
How Your Email Address Ends Up on Their Targeting List
Email and data breach cross-referencing plays a role that most people never consider. Here is how it works:
- You sign up for a gaming platform, newsletter, or community forum using your real email address.
- That platform gets breached, or it sells user data to data brokers.
- Brokers match your email to your gaming username and Discord profile.
- Scammers buy those lists and use the personal details to write openers that feel strangely familiar.
When a scammer’s first message feels oddly specific, this data breach email cross-reference pipeline is often why. Keeping your real email out of gaming sign-ups and new Discord communities limits what scammers can learn about you before they contact you. FreeMail.AI helps you manage your email presence with that separation built in, so your real identity does not end up on those lists.
What Are the Red Flags of the Infinity Kingdom Discord Scam?
Six red flags appear in nearly every reported case: the accidental-contact opener used to start a conversation, a new account with no mutual friends, a consistent female persona aged 23 to 28 based in Hong Kong or Singapore, avoidance of voice and video chat, scripted responses that steer back to Infinity Kingdom, and a download link that does not come from the official app stores.
Here is what each red flag looks like in practice:
- The accidental contact opener. Real people who message the wrong person say sorry and stop. Scammers use the “wrong person” line as a planned way to open a conversation with you.
- New account, no mutual friends. Most discord scam fake friend request accounts are new, often created after early 2022. They share no servers or friends with you beyond the one where they found you.
- The same demographic every time. The 23 to 28-year-old, female-presenting, Hong Kong or Singapore persona appears in thousands of confirmed reports across Reddit r/InfinityKingdom and Steam forums. It is a script, not a coincidence.
- No voice or video chat, ever. They always have an excuse, a bad microphone, a noisy room, feeling shy. A fake persona does not survive a ten-second video call.
- Rigid topic steering. Ask them a specific question about another game they say they enjoy. If they give a vague answer and bring the conversation back to Infinity Kingdom, they are working from a script.
- A download link that is not the official app store. This is the clearest signal of all. If the game is real, it is on the Google Play Store or Apple App Store. A private link from someone you just met is never safe to click.
What Can the Malware Actually Do to Your Device?
A Remote Access Tool installed through the modified Infinity Kingdom app can read your saved passwords, access your photo gallery, intercept SMS messages including two-factor authentication (2FA) codes, and in some versions give an attacker direct control over your device. The app connects to real YOOZOO Singapore game servers, so it plays exactly like the official version. There is no visible sign that anything is wrong.
Here is what a RAT can specifically do once it is on your phone:
- Read saved passwords stored in your browser and apps
- Access your photo gallery and camera roll
- Intercept SMS messages, including 2FA codes, which means the attacker can log into your other accounts even when two-factor authentication is turned on
- Copy your contact list and personal data
- In some versions, give the scammer full remote control of your device
The 2FA bypass point is especially serious. Many people count on two-factor authentication as a backup layer. If a Remote Access Tool is reading your SMS codes, that layer no longer protects you.
A factory reset is the only reliable fix because the app was installed with your permission. A normal uninstall does not always remove a RAT completely.
What Should You Do If You Have Been Targeted?
The right response depends on how far the interaction went. If you only chatted, block and report the account right now. If you downloaded the app from their link, factory reset your device. If you made payments through an outside website, call your bank immediately and file a fraud report with the FTC.
If You Chatted But Did Not Download Anything
- Block the account. Right-click their username in Discord and select Block.
- Report the message. Right-click the DM, select Report Message, and choose Scams or Fraud.
- Update your Discord privacy settings. Go to User Settings, then Privacy and Safety. Turn off “Allow direct messages from server members” for servers you do not fully trust.
- Warn others. Post in the server where you first encountered them. Other members in that server may be targeted next.
- If you shared personal details such as your name, location, or other usernames, change any related passwords as a precaution.
If You Downloaded the App from Their Link
Assume your device is compromised. Do not just delete the app. A factory reset malware removal is the only reliable option.
iPhone: Go to Settings, then General, then Transfer or Reset iPhone, then Erase All Content and Settings.
Android or Samsung: Go to Settings, then General Management, then Reset, then Factory Data Reset.
Two points before you reset:
- Do not restore from a backup created after you installed the suspicious app. That backup may contain the RAT.
- After resetting, change your passwords from a clean device, starting with your email, your bank accounts, and Discord.
- Turn on 2FA in Discord after the reset: User Settings, then My Account, then Enable Two-Factor Auth.
If You Made Payments Through an Outside Website
- Call your bank right away. Tell them the charges are fraudulent and ask for a new card number.
- If you paid through the Google Play Store or Apple App Store, contact Google or Apple support. Legitimate in-app purchases may be refunded when you explain the fraud clearly.
- File a report with the FTC at reportfraud.ftc.gov if you are in the US, or with Action Fraud at actionfraud.police.uk if you are in the UK.
- Screenshot the full conversation before you block the account. Those screenshots are evidence for your fraud report.
How to Report the Infinity Kingdom Discord Scam
If you are wondering how to report discord scam activity, the process takes only a few minutes and it genuinely helps. Discord acts on reports. According to the platform’s own 2026 Transparency Report, Discord removed over 3 million accounts for deceptive practices in a single year. Your report is part of that count.
| Where to Report | How to Do It | What It Does |
| Discord in-app | Right-click the message, then Report Message, then Scams or Fraud | Gets the account reviewed and often removed |
| Discord Trust and Safety | dis.gd/report | For large-scale or server-level scam operations |
| FTC (US) | reportfraud.ftc.gov | Adds to the national fraud enforcement database |
| Action Fraud (UK) | actionfraud.police.uk | Goes into UK law enforcement fraud records |
| r/InfinityKingdom (Reddit) | Post with the account name and what happened | Warns the gaming community and documents active aliases |
How to Reduce Your Exposure to Discord Scams
The 2025 Verizon Data Breach Investigations Report found that the human element, including social engineering attacks, plays a role in about 60% of all data breaches. The most useful protection is a change in habit, not just a change in software.
Five habits that make you a harder target:
- Lock down your Discord DMs. Go to User Settings, then Privacy and Safety. Turn off “Allow direct messages from server members” for servers you do not know well. This one setting blocks most cold-contact scam approaches before they ever reach you.
- Keep your real email out of gaming sign-ups. When your real email address is connected to dozens of gaming platforms, newsletters, and community forums, data breaches and broker sales build a profile that scammers can buy. When that email is not in those sign-ups, the targeting pipeline breaks down at the source. FreeMail.AI helps you manage your email presence with that separation in mind, so your real identity stays out of the lists that feed these attacks. Using temp mail for Discord and other gaming sign-ups is the most direct way to break that pipeline at its source.
- Turn on 2FA for Discord now. Go to User Settings, then My Account, then Enable Two-Factor Auth. Setting this up before anything goes wrong means an attacker with your password still cannot get in.
- Never download from a private link. It does not matter how long you chatted or how genuine the person seemed. If someone you met in a Discord DM asks you to install something, say no. Real games live on real app stores.
- Learn the pattern, not just the game name. Scammers swap game titles regularly. Infinity Empire, Avatar: Realms Collide, and others have all been used in the same discord gaming scam fake friend format. The game name changes. The five-stage playbook stays exactly the same.
Other Discord Scams That Follow the Same Playbook
The Infinity Kingdom variant is one of several Discord scams built on the same fake friend request opening. The game or prize used as bait changes, but the method stays consistent: unsolicited contact, rapport-building, then a link or money request.
Fake giveaway scams use a well-known name to add credibility. The MrBeast Discord scam is one of the most reported examples, where a message claims you were selected for a prize. The link leads to a page that collects your credentials.
Pig butchering scams follow a longer timeline, sometimes several weeks. The target is guided toward a fake investment platform that steals deposits. The infinity empire discord scam uses nearly the same setup, just swapping one game title for another. Research from the University of Texas at Austin found that global losses to pig butchering scams passed $75 billion between January 2020 and February 2024. Cyvers, an onchain security firm, found that pig butchering schemes on the Ethereum network alone cost the industry over $5.5 billion across 200,000 identified cases in 2024. The Global Anti-Scam Organization (GASO) estimates that the average victim loses close to $122,000.
Fake ban report scams skip the friendship stage entirely and use urgency instead. A stranger claims they accidentally reported your account and now it is at risk. They offer to connect you with a fake “support person” who will then try to steal your login credentials or personal details.
Compromised account phishing is harder to spot because the message comes from a real friend’s account that has already been taken over. The message looks trustworthy. The link is not. Check Point Research documented more than 1,300 victims across eight countries in a single Discord-based malware campaign in 2025.
In every case, the pattern is the same: someone contacts you, builds a reason for you to trust them, and then asks you to click something or pay something. Knowing the structure protects you from every version of the scam, not just this one.
Frequently Asked Questions
Is Infinity Kingdom itself a scam game?
No. Infinity Kingdom is a real mobile MMO strategy game made by YOOZOO Singapore, also distributed under GTarcade. You can find it on the Google Play Store and Apple App Store. The scammers who contact people on Discord have no connection to the game developers. What is fraudulent is the person who sent you the DM and the download link they provided, not the game itself.
Why does the scammer spend so long building rapport before asking for anything?
Because a sudden link from a stranger gets ignored. A link from someone you spent a day chatting with, someone who feels like a new friend, gets clicked. The rapport-building is the core technique, not a side effect of the scam. It works on the principle of reciprocity: when someone spends time on you, you feel a natural pull to return the favour. That pull is what makes the download request feel safe when it is not.
Can a factory reset fully remove the malware?
Yes, for the type of malware used in this scam. Remote Access Tools delivered through a user-installed app operate at the user level and are fully removed by a factory reset. The one step to remember: do not restore from a backup that was created after you installed the suspicious app. That backup may contain the RAT. Start fresh after the reset, then change your passwords from a clean device.
I replied to the DM but did not download anything. Am I at risk?
The risk is low but not zero. Replying tells the scammer that your account is active and monitored. You may get follow-up messages from the same operation using different usernames. Block the account, report it through Discord’s in-app tool, and turn off DMs from untrusted server members in your Discord privacy settings. If you shared personal details like your name or location, change related passwords as a precaution.
Can Discord scammers steal my password?
Yes, through several methods. A phishing Discord page can capture your credentials when you enter them on a fake login screen. Malware from a malicious APK can pull saved passwords directly from your device and intercept SMS-based 2FA codes. In some cases, the attacker gets full remote access to your phone. Turning on two-factor authentication in Discord limits the damage even if your password is exposed.
I feel embarrassed that I almost fell for this. Is that normal?
Very normal. This scam is built around documented principles of social psychology, not your lack of experience. The 24-hour rapport-building phase works on people specifically because humans are wired to trust those who invest time in them. Being nearly tricked by this says nothing about your intelligence. It says a great deal about how carefully this scam was designed. Report it, warn others in your gaming community Discord server, and move on.
How does my email address make me a more vulnerable target for Discord scams?
Scammers cross-reference gaming usernames with email addresses from data breaches and data broker lists. When your real email is tied to gaming platforms and community sign-ups, it can be matched to your Discord profile. This gives scammers personal context before they contact you, which makes their opener feel more specific and convincing. Keeping your real email out of those data pipelines makes you a much harder person to profile and target.
Protecting your real email address is one of the most practical steps you can take against social engineering like this. When your email is not connected to every gaming platform, newsletter, and community sign-up, scammers lose one of the tools they rely on most. FreeMail.AI helps you manage your email presence with that thoughtful separation built in, so your real identity stays out of the data pipelines that make attacks like the infinity kingdom discord scam work. Visit freemail.ai to learn more.