Steal Microsoft and Minecraft credentialsĪs of 10:45 California time, only four of the major antivirus engines detect Fracturiser, according to samples of the malware posted to VirusTotal here and here.

Replace cryptocurrency addresses in the clipboard with alternate ones.

Steal cookies and login information for multiple Web browsers.

Propagate itself to all JAR (Java archive) files on the filesystem, possibly allowing Fracturiser to infect other mods that weren’t downloaded from CurseForge or BukkitDev.

Stage 3, believed to be the final stage in the sequence, creates folders and scripts, makes changes to the system registry, and goes on to perform the following: Each stage downloads files from a command-and-control server and then calls for the next stage. It’s delivered in stages that are initiated by Stage 0, which begins once someone runs one of the infected mods. Participants posting in the forum said the malware used in the attack, dubbed Fracturiser, runs on Windows and Linux systems. Ultimate Titles Animations Gradient RGB.Create Infernal Expansion Plus - Mod removed from CurseForge.Officials with Prism Launcher, maker of an open source Minecraft launcher, described the infections as “widespread” and listed the following mods as affected:

There are reports of malicious plugin/mod JARs as early as mid-April.”

“Some of these malicious copies have been injected into popular modpacks including Better Minecraft. “A number of Curseforge and (not the Bukkit software itself) accounts were compromised, and malicious software was injected into copies of many popular plugins and mods,” gamers wrote in a forum dedicated to discussing the event. Fracturiser infecting Windows and Linux systems , a developer platform run by CurseForge, is also believed to be affected. Some of the malicious files used in the attack date back to mid-April, a sign that the account compromises have been active for weeks.

The mod-developer accounts were hosted by CurseForge, a platform that hosts accounts and forums related to add-on software known as mods or plugins, which extend the capabilities of the standalone Minecraft game. A platform that provides plugin software for the wildly popular Minecraft game is advising users to immediately stop downloading or updating mods after discovering malware has been injected into dozens of offerings it makes available online.

Minecraft modpacks regular launcher