Malicious Minecraft Mod Deploys Myth Stealer 3.2-FIX in Sophisticated Cyberattack
A trojanized Minecraft optimization mod, disguised as a companion to the legitimate Lithium performance mod, has been distributing Myth Stealer 3.2-FIX a password-stealing malware with remote-access, surveillance, and victim-harassment capabilities. The malicious archive, tracked as MythStealer.jar, impersonates Lithium Extras 0.15.0+mc1.21.1 by a developer named "soder," leveraging the reputation of CaffeineMC’s open-source Lithium project to appear trustworthy.
The counterfeit mod initially functions as expected, with 12 of its 13 modules performing legitimate optimization tasks. However, the hidden 13th component delays execution for eight seconds before querying ip-api[.]com for the victim’s public IP and country code, collecting the hostname, and downloading a secondary payload from Dropbox. The downloaded executable, DiscordNitroGenerator.exe, is saved to %APPDATA%\Microsoft\Windows\javaw.exe a path designed to evade detection by blending into systems where Java is commonly used for Minecraft.
The first-stage dropper reports infection progress to a Discord webhook and re-downloads the payload if missing or under 50 MB. At the time of discovery, both the Java archive and the 169 MB executable showed zero detections on VirusTotal, likely due to the campaign’s use of a newly created Discord webhook and seemingly legitimate mod functionality.
The malware bundles a private Java runtime, allowing it to execute even on systems without Java installed. Before launching the payload, the loader displays a fake Windows UAC prompt via PowerShell WinForms, tricking users into granting elevated privileges. The stealer then disables Java bytecode verification, enabling the execution of heavily obfuscated malicious code.
Myth Stealer 3.2-FIX is a Java-based remote-access tool (RAT) with 251 classes hidden in a package named complexer/NUL, exploiting the Windows reserved device name NUL to disrupt analysis tools. Its capabilities include:
- Credential theft: Harvests saved usernames, passwords, payment card details (including CVVs), and browser cookies from Chromium and Firefox-based browsers.
- System profiling: Collects hostname, hardware IDs, OS details, and hardware identifiers via WMI queries.
- Data exfiltration: Steals chat logs, browsing history, and local files, which it can ZIP and exfiltrate.
- Remote control: Enables process hollowing, fileless execution, AMSI bypass, ETW patching, and direct manipulation of the victim’s mouse and keyboard.
- Victim harassment: Includes disruptive functions such as screen rotation, cursor replacement, taskbar hiding, fake error messages, and optical-drive control.
The malware communicates with command-and-control (C2) servers via a custom Netty-based TCP protocol, using RSA-OAEP-protected AES-GCM encryption despite lacking TLS. Researchers identified two C2 configurations: the IP 146[.]19[.]191[.]11 and the domain ays[.]gamepazarin[.]com, which mimics the legitimate Turkish game marketplace gamepazari[.]com.
The campaign highlights how threat actors combine functional game modifications, trusted project impersonation, and social engineering to evade detection. Users are advised to download mods only from verified sources such as Modrinth, CurseForge, or official developer repositories. Indicators of compromise (IOCs) include the SHA256 hashes for MythStealer.jar, DiscordNitroGenerator.exe, and client.jar.
Source: https://gbhackers.com/fake-minecraft-mod-drops/
Dropbox TPRM report: https://www.rankiteo.com/company/Dropbox
CurseForge TPRM report: https://www.rankiteo.com/company/curseforge
Modrinth TPRM report: https://www.rankiteo.com/company/rinth-labs
"id": "currinDro1788769843",
"linkid": "curseforge, rinth-labs, Dropbox",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'industry': 'Gaming',
'location': 'Global',
'name': 'Minecraft Players',
'type': 'Individual Users'},
{'industry': 'Software Development',
'name': 'CaffeineMC (Lithium Mod Developer)',
'type': 'Organization'}],
'attack_vector': 'Trojanized Software (Malicious Mod)',
'customer_advisories': 'Users advised to avoid downloading mods from '
'untrusted sources and to verify the authenticity of '
'mods claiming to be companions to legitimate '
'projects.',
'data_breach': {'data_encryption': 'No (data exfiltrated in plaintext or '
'encrypted via custom protocol)',
'data_exfiltration': 'Yes (ZIP and exfiltrate local files)',
'personally_identifiable_information': 'Yes (saved usernames, '
'passwords, payment '
'details, browser '
'cookies)',
'sensitivity_of_data': 'High (PII, financial data, '
'authentication tokens)',
'type_of_data_compromised': ['Credentials',
'Payment Card Details',
'Browser Cookies',
'Chat Logs',
'Browsing History',
'Local Files']},
'description': 'A trojanized Minecraft optimization mod, disguised as a '
'companion to the legitimate Lithium performance mod, has been '
'distributing Myth Stealer 3.2-FIX, a password-stealing '
'malware with remote-access, surveillance, and '
'victim-harassment capabilities.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'CaffeineMC’s Lithium mod due to '
'impersonation',
'data_compromised': 'Saved usernames, passwords, payment card '
'details (including CVVs), browser cookies, '
'chat logs, browsing history, local files',
'identity_theft_risk': 'High (harvested PII and credentials)',
'operational_impact': 'Remote control of victim systems, '
'disruption of user activities (e.g., screen '
'rotation, cursor replacement, taskbar '
'hiding)',
'payment_information_risk': 'High (payment card details including '
'CVVs)',
'systems_affected': 'Windows systems with Minecraft and Java '
'installed'},
'initial_access_broker': {'backdoors_established': 'Hidden 13th module in the '
'mod',
'entry_point': 'Trojanized Minecraft mod (Lithium '
'Extras 0.15.0+mc1.21.1)'},
'lessons_learned': 'Threat actors leverage trusted project impersonation and '
'functional game modifications to evade detection. Users '
'must verify sources before downloading mods.',
'motivation': 'Credential Theft, Remote Access, Data Exfiltration, Victim '
'Harassment',
'post_incident_analysis': {'corrective_actions': 'Enhanced verification of '
'mod sources, user education '
'on risks of third-party '
'mods, monitoring for IOCs',
'root_causes': 'Social engineering (impersonation '
'of trusted mod), delayed execution '
'of malicious payload, use of '
'obfuscation and reserved device '
'names to evade detection'},
'ransomware': {'data_encryption': 'No (malware focuses on theft and remote '
'access)',
'data_exfiltration': 'Yes'},
'recommendations': 'Download mods only from verified sources (Modrinth, '
'CurseForge, official repositories). Monitor for IOCs such '
'as SHA256 hashes of MythStealer.jar and '
'DiscordNitroGenerator.exe.',
'references': [{'source': 'Cybersecurity Research Report'}],
'response': {'remediation_measures': 'Users advised to download mods only '
'from verified sources (Modrinth, '
'CurseForge, official repositories)'},
'title': 'Malicious Minecraft Mod Deploys Myth Stealer 3.2-FIX in '
'Sophisticated Cyberattack',
'type': 'Malware Distribution',
'vulnerability_exploited': 'Social Engineering (Impersonation of Trusted Mod)'}