Popular "Minecraft" mods infected with malware
Dozens of popular "Minecraft" mods and plugins have been infected by the Fracturiser malware. Among other things, it can steal login data from affected computers.
CurseForge, one of the largest hosting platforms for "Minecraft" mods, urgently advises users to stop downloading or updating new mods and plugins. Dozens have been infected by the Fracturiser malware. Hackers have apparently hacked several developer accounts of the hosting platforms CurseForge and Bukkit and were able to smuggle the malicious code into the "Minecraft" mods in this way. These included extremely popular ones such as "Better "Minecraft"", which has been downloaded well over four million times.
What does the malware do and how do I get rid of it?
Fracturiser runs on Windows and Linux and is infiltrated into the systems in three phases as soon as an infected mod is started. In each of the three phases, additional code is downloaded from the network, making it extremely difficult for virus scanners to detect the malware. In the third stage - currently the last known - Fracturiser creates folders and scripts and makes changes to the system registry. It uses this to steal various sensitive data, including:
- The login details of your Discord, Microsoft and "Minecraft" account
- Web cookies and login data from various browsers
The malware also searches the clipboard for cryptocurrency addresses and attempts to steal other
infect other "Minecraft" mods and thus spread.
CurseForge, who discovered the problem, provide a guide here to help you find out if your system is infected with Fracturiser and how to get rid of it. They also list which mods have already been proven to be infected with the malware - and point out that the incident must presumably have occurred within the last 30 days.
Cover image: «Minecraft»
I've been tinkering with digital networks ever since I found out how to activate both telephone channels on the ISDN card for greater bandwidth. As for the analogue variety, I've been doing that since I learned to talk. Though Winterthur is my adoptive home city, my heart still bleeds red and blue.