Bots are adding League of Legends players as friends within seconds of a match ending, opening with a compliment about how you played, and moving the conversation to Discord within minutes. What waits at the end of that funnel is usually a paid subscription page for a person who does not exist, and in some cases a link built to take over your Discord account.
Malwarebytes documented the pattern in a report published on August 7, 2026, built on a firsthand account from Lina K., a colleague of the author, and set against months of similar complaints in Reddit and Facebook gaming communities. The script itself is an ordinary romance scam. What is new is the entry point: the game client.
What the requests look like
The approach is close to identical every time, according to the players who reported it. A friend request arrives in the Riot client moments after a game ends, from a name that did not appear in that match. The opener is generic flattery about your playstyle, and when pressed, the account claims to have been on the enemy team. Many present themselves as a woman looking for a duo partner. The profile behind it tends to be blank: no match history, no overview data, sometimes a very low account level, all signs of a throwaway account made or bought for outreach. Malwarebytes notes that some are stolen accounts instead.
After a short exchange the contact says it is logging off soon and hands over a Discord username. That handoff is the point of the whole opener, because it lifts the conversation onto a platform where Riot's chat protections do not reach.
The tell is the photo set
On Discord the persona shifts into hours of rapport building paired with suggestive but non-explicit photos, ending in a link to a paid subscription platform framed as a limited offer. A reverse image search on photos from one such conversation found the same pictures recycled across unrelated sites and a YouTube video, whose commenters described receiving identical images from accounts using different names. Lina also described a bot swapping in a photo with a concerned expression after being left on read, which reads as a scripted reaction to silence rather than a person's.
One detail cuts against calling these pure chatbots. When the account was hit with a prompt injection attempt, text dressed up as a system message ordering it to break character and print its configuration, it did not comply and stayed in persona. Malwarebytes reads that resilience as either deliberate guardrails or, more likely, a scripted flow with AI generated text layered on top rather than an open chatbot.
How the bots find you
Players report requests after essentially every match, with no way to tell a real player's request from a bot's inside the client. Community threads speculate that the operators watch public match data through third-party stats trackers and their APIs to spot games that have just ended. Riot has not confirmed that, and Malwarebytes flags it as unverified. There is one suggestive clue: several affected players found that turning on the client's streamer mode, which hides recent match and online status, cut the number of requests they received.
Why this is more than an ad
The usual payoff is a subscription rather than theft. But community reports describe some of these accounts eventually sending links designed to hijack the recipient's Discord account or harvest credentials, the same end state as the fake moderation report scam stealing Reddit and Discord accounts. A hijacked account is then well placed to run the next round against its owner's own friends list, the pattern also seen in the WhatsApp vote link takeovers.
What you should do
- Treat any friend request from a name that was not in your last game as suspicious, especially one that lands seconds after the match.
- Turn on streamer mode or equivalent privacy settings to limit what outside parties can see about your activity.
- Be wary of anyone who pushes the conversation to Discord early, particularly with a reason to hurry.
- Reverse image search any early profile photos. Recycled images are the most reliable tell.
- Restrict who can send you DMs and friend requests on Discord, and turn on multi-factor authentication.
- Do not click links from unfamiliar contacts, even ones framed as a harmless subscription page.
- Report the accounts to Riot Support and to Discord Trust and Safety, which feeds the pattern data platforms use to ban clusters of bot accounts.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.