A Discord token is a session credential that proves an account is already logged in. Instead of stealing a password and signing in normally, an attacker who gets the token may be able to act as the victim inside Discord until the session is revoked or expires. That can expose chats, servers, private messages, and account-linked services.
Tokens matter because they bypass some of the usual login checks. Malware that targets gamers and Discord users often searches browsers, local app data, and injected processes for saved session artifacts, then sends them to the operator for account takeover or resale. Defenders reduce this risk by avoiding untrusted downloads, using multi-factor authentication, watching for unusual logins or message activity, and revoking sessions after suspected compromise.