You're browsing a Discord server — Dark Souls, Skyrim, whatever — when a DM arrives. Someone says they added you by mistake, apologises, then starts chatting. They're friendly, funny, easy to talk to. A day later they suggest playing a mobile game together. You download it. Then things get expensive, or worse.
This is the Infinity Kingdom Discord scam. It's well-organised, surprisingly patient, and it's catching out gamers who consider themselves switched-on. Here's how it works and what to do about it.
What Is the Infinity Kingdom Discord Scam?
Infinity Kingdom is a legitimate mobile MMO developed by YOOZOO Games. Scammers have nothing to do with the game's developers — they simply use it as a vehicle. The game itself is real; the person inviting you to play it is not who they claim to be.
The scam has two main payoffs for the people running it:
- Malware installation — getting you to download a modified version of the app that contains a Remote Access Tool (RAT), giving them access to your device
- Financial pressure — getting you inside the game and socially engineering you into spending money through in-game purchases or fake external payment sites
Both can happen together.
How the Scam Works Step by Step
What makes this scam unusually effective is patience. This is not a "click this link" hit-and-run. It's a deliberate 24-hour relationship-building operation.
Step 1 — The accidental add
The scammer sends a DM along the lines of: "Hey, are you [Name] from the [Game] team? Sorry, I think I added the wrong person." When you say you don't know them, they don't leave. They use it as an opening: "Oh well, since we're both gamers maybe we can chat anyway?"
Step 2 — Building the fake friendship
They then spend hours — sometimes a full day — talking to you. What are you cooking? What games do you like? They share photos of food or daily life. They have a consistent backstory: usually 23–28 years old, based in Hong Kong, Singapore, or Malaysia, often presenting as a young woman using an anime avatar or AI-generated photo.
Common account names documented in this scam: Sylvia, Janice, Sharon_xl, Philyy.45. New aliases appear regularly.
Step 3 — The invitation
Once enough rapport has been built, they suggest playing Infinity Kingdom together. Their alliance needs one more member. It'll only take five minutes to set up. They'll wait.
Step 4 — The dangerous link
Here's where it gets serious. Instead of pointing you to the Google Play Store or Apple App Store, they send you a direct download link — usually framed as a regional version, a special build, or a faster download. This link leads to a modified APK that looks and plays exactly like the real game, because it connects to the real servers. The difference is that it also contains a Remote Access Tool running silently in the background.
Step 5 — The financial pressure
Once you're in the game, the social pressure ramps up. Your new "friend" tells you the alliance needs you to buy a bundle to help in an upcoming battle. It starts small — under a pound or dollar — but quickly escalates into tens or hundreds. Sometimes they direct you to an external payment site, claiming the in-game store is having issues. That site is built to steal your card details.
The Red Flags at a Glance
If you receive an unsolicited DM on Discord, check for these:
The accidental contact opener. Real people who message the wrong person apologise and leave. Scammers use it as a conversation starter.
New account, no mutual friends. Most scam accounts were created recently and share no servers or friends with you beyond the one where they found you.
Consistent demographic profile. The 23–28 / Hong Kong or Singapore / female persona is a documented script. It's not a coincidence.
Avoidance of voice or video chat. They'll always have an excuse — bad microphone, noisy environment, shy. This is how they maintain a fake persona.
Rigid conversation steering. Ask them about a specific game mechanic or niche gaming topic. If they pivot back to Infinity Kingdom without really engaging, they're working from a script.
A download link that isn't the official app store. This is non-negotiable. If someone wants you to download an app from a link they personally sent rather than the App Store or Play Store, stop.
What Happens If You Install the Malicious App
A Remote Access Tool running on your phone is genuinely serious. Once installed, it can:
- Read saved passwords stored on your device
- Access your photo gallery
- Intercept SMS messages — including two-factor authentication codes, meaning it can bypass 2FA on your other accounts
- Give the scammer direct control over your device in some versions
The app looks and functions identically to the real game. You'd have no obvious sign anything was wrong.
What to Do If You've Been Targeted
If you chatted but haven't downloaded anything:
Block and report the account in Discord. Right-click the message, select Report Message, and choose Scams or Fraud. Then go to User Settings → Privacy & Safety and turn off "Allow direct messages from server members" on servers you don't fully trust.
If you downloaded the app from their link:
Assume your device is compromised. The most reliable fix is a factory reset — this removes user-level malware including most RATs. Do not restore from a backup taken after you installed the app, as the malware may be in the backup.
- iPhone: Settings → General → Transfer or Reset iPhone → Erase All Content and Settings
- Android/Samsung: Settings → General Management → Reset → Factory Data Reset
After resetting, from a clean device, change your passwords — starting with email, banking, and Discord.
If you made payments through an external site:
Call your bank immediately to report the charges as fraudulent and request a new card. Gather any receipts or screenshots you have for the fraud report.
How Your Discord Account Ends Up on Their Radar
Scammers don't pick their targets completely at random. They browse member lists of popular gaming servers looking for accounts that look like active players — profile pictures, status messages, recent activity. The more your real identity is attached to your Discord presence, the easier you are to research and target convincingly.
This connects directly to email. If your Discord account email has appeared in data breaches or been sold through data brokers, scammers can cross-reference it with other records to build a more convincing approach. The less real contact information you've attached to various gaming accounts and sign-ups, the harder you are to profile.
Using a disposable email address for gaming-related sign-ups — new Discord servers, game registrations, gaming newsletters — means any breach or sale of that data is a dead end. VanishInbox generates a working inbox in seconds with no account required. Use it wherever you're not completely sure of a service's data practices, and your real email stays off the lists scammers work from. For how these data pipelines actually work, see what happens when a website sells your email address.
A Simple Rule That Stops This Scam
If someone contacts you on Discord out of nowhere and, within 24 hours, suggests you download something — it's a scam.
It doesn't matter how friendly the conversation was. It doesn't matter how real they seemed. The friendliness is the technique, not the relationship. The entire preceding conversation was designed to get you to that download.
The rule: never download anything from a link sent by someone you met in a Discord DM, regardless of how much rapport has been built. If the game is real, it's on the official app stores. Anyone pushing a different download source is pushing malware.
Frequently Asked Questions
Is Infinity Kingdom itself a scam?
No. It's a legitimate game developed by YOOZOO Singapore. The scam uses the game's name and interface as cover — the developers have nothing to do with it. You can find the real game on the Google Play Store and Apple App Store.
Why does the scammer spend so long building rapport instead of just sending a link?
Because a sudden link from a stranger gets ignored. A link from someone you've spent a day chatting with, who feels like a genuine new friend, gets clicked. The 24-hour patience is the technique — it specifically bypasses the instinct that would otherwise make you suspicious.
Can I report the specific usernames like Sharon_xl or Philyy.45?
Yes — report them through Discord's in-app tool (right-click the message → Report Message). You can also post to r/InfinityKingdom on Reddit or relevant gaming communities to warn other players. Scammers cycle through usernames, so the goal is to get the account itself removed.
I installed the app but I'm not sure it was the malicious version. How do I tell?
You generally can't tell by looking at it — the malicious version functions like the real game. If you installed it from a link rather than the official app store, treat it as compromised and perform a factory reset. It's not worth the risk of leaving a potential RAT on your device.
Can a factory reset really fix this?
Yes, for the type of malware used in this scam. RATs installed via user-downloaded APKs operate at the user level and are wiped by a factory reset. The important caveat: don't restore from a backup created after you installed the suspicious app.
I feel embarrassed that I fell for this. Is that normal?
Very much so — and it's worth understanding why. This scam is designed by people who understand social psychology. The slow rapport-building specifically exploits the fact that humans are wired to reciprocate friendliness and feel obligation to people who've invested time in them. Being tricked by this doesn't reflect on your intelligence — it reflects on how deliberately the scam was constructed. Report it, fix it, and move on.
