Case Operation: Ghost Login

A 16-year-old student at Lëtzebuerg Digital High School, Alex Mercer, woke up to dozens of panicked messages from classmates. Someone had taken over Alex's Discord account overnight and used it to spam a fake "Free Nitro" link to everyone in the school's gaming server — and several students clicked it, losing their own accounts in a chain reaction.

Alex swears they never clicked anything suspicious. Their password was strong. 2FA was on. Yet the account was fully hijacked with no login notification and no 2FA prompt triggered. How is that possible?

As a Cyber Detective, your mission is to examine the digital trail — login logs, suspicious emails, downloaded files, and witness statements — and identify who engineered the attack and how they bypassed every security measure Alex thought they had.