Minecraft players watch out - these fake mods are hiding password-stealing malware

Date:
Thu, 19 Jun 2025 18:24:00 +0000

Description:
Large-scale operation was spotted on GitHub, targeting Minecraft players' login credentials, Telegram data, and more.

FULL STORY ======================================================================Check Point Research finds hundreds of malicious GitHub repositories These impersonate different mods or cheats for Minecraft The infostealers grab Minecraft data, as well as browser and crypto wallet information

Minecraft players are being actively targeted by a group of cybercriminals interested in their login credentials, authentication tokens, and crypto wallet information, experts have warned.

Cybersecurity researchers Check Point Research recently discovered the large-scale operation, run by a group called the Stargazers Ghost Network, a distribution-as-a-service (DaaS) operation active for a year now,
distributing malware and infostealers on behalf of other cybercriminals.

In this campaign, the crooks abused the fact that Minecraft is one of the largest games in the world, with an active, thriving community of players and modders. Minecraft mods are player-built additions to the game and as per the researchers, there are more than a million modders out there. Hundreds of repos

The attackers created malicious GitHub repositories, spoofing legitimate
mods, and pretending to be cheats: Skyblock Extras, Polar Client, FunnyMap, Oringo, and Taunahi, are just some of the names making rounds.

CheckPoint says these have had thousands of views on Pastebin, suggesting
that the campaign is rather successful.

To make matters worse, since these are custom-built to target Minecraft
users, and since both the downloader and the malware are written in Java,
they are currently going undetected by all antivirus engines.

"We have identified approximately 500 GitHub repositories, including those that are forked or copied, which were part of this operation aimed at Minecraft players," one of the researchers told BleepingComputer .

"We've also seen 700 stars produced by approximately 70 accounts." Stars are used to boost the legitimacy of the repositories, thus improving the chances of infection.

The attack is split into two phases. The first phase targets Minecraft
account tokens, and user data from both the Minecraft launcher, and some third-party launchers. It also steals Discord and Telegram information.

The second stage deploys a more traditional infostealer called 44 Caliber, which steals browser data, VPN information, crypto wallet data, and more. You might also like Experts warn GTA and Minecraft being used to lure in cyberattack victims - here's how to stay safe Take a look at our guide to the best authenticator app We've rounded up the best password managers



======================================================================
Link to news story: https://www.techradar.com/pro/security/minecraft-players-watch-out-these-fake- mods-are-hiding-password-stealing-malware


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)