Minecraft Mods Infected with Stealer Malware via Stargazers Network

Security researchers at Check Point Research have uncovered a dangerous campaign distributing Minecraft mod malware through GitHub repositories. Which not only concerns cybersecurity experts but gamers everywhere.

The campaign, dubbed the Stargazers Ghost Network, targets unsuspecting players by disguising malware as popular modding tools like Oringo and Taunahi. Once installed, these infected mods silently deploy credential-stealing malware on the victim’s system.

How the Minecraft Mod Malware Works

The infection begins when players manually install seemingly harmless .jar mod files from GitHub. These files act as loaders, initiating a multi-stage malware chain that downloads and executes Java-based and .NET-based information stealers.

Detecting analysis tools or virtual machines is the primary goal of the first phase. It then retrieves a second-stage payload from Pastebin if none are detected. Data from custom launchers like Lunar, Feather, and Essential, as well as Minecraft session tokens and Discord credentials, are among the sensitive information that this malware harvests.

The second stage then triggers a third payload that dives even deeper (written in .NET). It targets browser passwords, cryptocurrency wallets, VPN credentials, and more. The stolen data is zipped and sent via Discord webhooks, all while evading antivirus detection.

Why This Mod Malware Is So Dangerous

Most scanning systems do not support the Minecraft Forge runtime environment, which the malware uses to evade sandbox analysis, according to Check Point. The phony mods looked real because they were hosted on GitHub, and the social proof was provided by the many star repositories.

Moreover, researchers discovered evidence that linked the threat actor to Russia. Code comments, UTC+3 commit timestamps, and Pastebin usernames like “JoeBidenMama” point to a developer with Russian as a primary language.

The malicious pastes of this campaign had over 1,500 hits, suggesting a widespread potential for infection.

Stay Safe: Tips for Minecraft Players

• Only download mods from trusted sources like CurseForge or official developer sites.

• Never run .jar files unless you fully trust the source.

• Use antivirus software that supports Java threat detection.

• Monitor mod behavior closely after installation.