Hackers were seen, once again, using Minecraft to distribute infostealers among the gaming community, capable of hijacking cryptocurrency transactions, stealing Discord authentication tokens, as well as cookies and login data saved in browsers.
According to cybersecurity researchers at Bitdefender, unknown hackers managed to compromise several developer accounts on CurseForge and Bukkit. These are modding communities where Minecraft fans meet to build and share various mods and plugins for the popular sandbox game.
The mods and plugins found on those accounts were then infected with the abovementioned infostealing malware. Given that they were subsequently added to different modpacks, their downloads are being counted in the millions, the researchers are saying.
Active development
The analysts claim that the earliest signs of the malware were detected in April 24, 2023. This version lacked many of the features it now has, suggesting that the attackers are actively developing the malware.
At the moment, the attackers are targeting mostly Linux and Windows endpoints, with the majority of victims being located in the United States. The researchers are also saying that the infostealer has a unique feature that targets modders and developers, exclusively.
In the later stages of infection, the malware will go for Windows Sandbox instances, which the mods usually use for testing. It will try to constantly infect the clipboard, in an attempt to infect the host.
“This behavior is isolated to Windows Sandbox, as it is the only virtualization environment that allows alteration of the host clipboard contents when the virtual machine is running in the background,” the researchers said.
So far, “dozens” of mods and plugins were found to be compromised with this malware, the report concludes. The full list of the affected plugins can be found on this link.
Minecraft is an immensely popular sandbox game, with currently more than 140 million active players.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba