Fake Minecraft Mod Delivers Myth Stealer RAT to Hijack Browser Credentials

Key Takeaways

• A malicious Minecraft mod, disguised as a performance optimization tool, is actively distributing the Myth Stealer Remote Access Trojan (RAT).
• The fake mod functions as advertised, deceptively lulling users into a false sense of security before initiating a multi-stage infection.
• Myth Stealer targets sensitive browser data, including passwords, cookies, and browsing history, alongside providing extensive remote control over infected Windows systems.
• The malware employs sophisticated evasion techniques, including a custom Java runtime and obfuscated code, making detection challenging for standard security tools.
• Users are urged to download mods only from official sources and exercise extreme caution with any unexpected administrator prompts.

A deceptive Minecraft optimization mod is currently deploying Myth Stealer, a potent malware capable of pilfering browser credentials, cookies, and other sensitive user data. This malicious file cleverly masquerades as a legitimate utility, with its advertised features operating as expected, thereby giving players little reason to suspect an underlying threat.

The ongoing campaign capitalizes on players’ desire for enhanced game performance, leveraging unofficial add-ons as its distribution vector. Once installed, this counterfeit mod initiates a sophisticated, multi-stage infection sequence. This ultimately leads to the deployment of a remote access tool that grants its operators extensive data collection capabilities and broad control over compromised Windows devices.

The discovery of this malware was made by analyst devmihaylov said in a report shared with Cyber Security News (CSN). The analyst noted that the initial samples of the malware registered zero detections on VirusTotal. This highlights how new or lightly distributed threats can effectively bypass reputation-based security checks, making early detection particularly challenging.

Minecraft players frequently find themselves targeted by malware distributors. Previous incidents involving fake Minecraft Fabric mods have demonstrated how seemingly innocuous game downloads can serve as the initial vector for account theft and system compromise. These threats often combine a functional decoy with a stealthy loader designed to integrate seamlessly into a typical gaming environment.

Fake Minecraft Mod

The Java archive at the heart of this attack presents itself as a legitimate companion to an existing optimization project. It includes twelve fully functional modules designed to enhance game performance settings. However, a hidden thirteenth component lies in wait. After a brief delay, this clandestine module gathers system information, then retrieves and executes the next stage of the malware in the background. This tactic is crucial, as victims observe the expected performance improvements, reinforcing the perception that the download is safe.

The loader component is a substantial executable, built around a standard runtime, and notably incorporates its own private Java environment. This design ensures the payload can execute effectively even on systems where Java is not otherwise installed.

Before launching its final stage, the program displays a meticulously crafted administrator-rights request, designed to mimic a standard Windows prompt. Granting this request significantly elevates the malware’s privileges, facilitating its installation and persistence. The loader also integrates retry logic, engineered to overcome interruptions by security software during the infection process.

The final payload is heavily obfuscated to impede analysis. Its code utilizes reserved Windows-style names, encrypted strings, and various anti-analysis techniques designed to disrupt basic extraction tools. This elaborate concealment, coupled with the mod’s apparent legitimacy, renders a quick visual inspection of the downloaded file an unreliable security measure.

Credential Theft and Remote Control

Myth Stealer specifically targets sensitive data stored by Chromium-based browsers and Mozilla Firefox. This includes saved usernames, passwords, browsing history, and active session cookies. The theft of session cookies is particularly dangerous, as it can enable attackers to hijack already authenticated web sessions without needing to re-enter credentials. The persistent value of browser passwords and cookies as targets in data-theft operations remains consistently high.

Beyond browser data, the malware also harvests comprehensive system information, chat logs, clipboard contents, and various files. It possesses the capability to capture screenshots and even record webcam footage. Its robust remote-control functionalities include executing arbitrary commands, downloading or deleting files, managing running processes, and establishing persistence to restart automatically after a system reboot.

Researchers have also uncovered disruptive functions within the malware. These include the ability to alter display settings, interfere with mouse and keyboard inputs, display misleading full-screen messages, and attempt to block access to security tools. Such features complicate victim recovery efforts and can be used to pressure users into complying with an attacker’s demands.

The operation utilizes web-based reporting channels to exfiltrate stolen information, a technique seen in other malware campaigns involving Discord webhook abuse. Although the command and control (C2) infrastructure analyzed was no longer responsive at the time of reporting, inactive servers do not negate the risk to systems already infected.

What You Should Do

• Source Mods Carefully: Always download Minecraft mods exclusively from official project pages and verified developers. Avoid downloads promoted through suspicious chat links, YouTube videos, or unofficial file-sharing sites.
• Verify File Integrity: Before installing any mod, ensure its authenticity by checking developer signatures or comparing file hashes against official sources if available.
• Be Wary of Admin Prompts: An unexpected request for administrator privileges during a mod installation is a critical warning sign. Legitimate mods rarely require such elevated access.
• Regular Security Scans: If you suspect you’ve installed a malicious mod, immediately remove it and perform a comprehensive scan of your system using reputable antivirus or anti-malware software.
• Change Passwords and Invalidate Sessions: From a clean device, change all important passwords (especially for gaming accounts, email, and banking). Log out of all active web sessions to invalidate any potentially stolen cookies.
• Review Browser Extensions and Startup Programs: Check your web browsers for any unfamiliar extensions and review your system’s startup programs for any unknown or suspicious entries.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.