Malware can inject itself into almost any app in real time, to either steal the tokens or intercept the credentials. Almost any app that you had installed is compromised.but i dont login to discord using browser, I have installed the application on both windows and android. Session cookies can be stole via that route too? I thought its meant for browsers only.