Minecraft gamers have been warned about a rapidly growing multi-stage malware campaign targeting modpacks and plugins.
Cybersecurity firm Bitdefender described how an information-stealing malware named “Fractureiser” is targeting users of a popular cross-platform game in a high alert posted at 18.00 BST on June 8. provided details.
Researchers said several CurseForge and Bukkit accounts were compromised and used to publish updates to malware-powered mods and plugins without the knowledge of the original authors. These mods are built into popular modpacks that have been “downloaded millions of times to date”.
Mods are user-created add-ons that enhance gameplay, and their collections are organized and organized in the form of Modpacks. CurseForge and Bukkit are his two largest Minecraft mod repositories.
Read more: Hackers, scammers and thieves – about cybersecurity in the gaming industry
Fractureiser malware is downloaded in four stages, labeled 0 to 3. Stage 3 provides the final payload in the form of a JAR file containing a native binary named hook.dll.
The virus currently affects Linux and Windows Minecraft installations and attempts to propagate itself to all JAR files on the system, including those that are not part of Minecraft Mods.
Once files are modified, malware can target victims in a number of ways. First, they can hijack cryptocurrency transactions by exchanging wallet addresses with attackers. Fractureiser can also steal her cookies and user credentials from web browsers and steal authentication tokens for Discord, Microsoft, and Minecraft.
Bitdefender highlighted “interesting conduct that appears to be directed at mod or plugin developers.” This is because Stage 3 malware targets Windows Sandbox, the only virtualization environment that allows modification of the contents of the host clipboard while the virtual machine is running in the background.
“We have been able to confirm that dozens of mods and plugins have been crafted with malware,” the alert said, adding that “the overwhelming majority of victims are in the United States.”
The company listed the affected mods in its Indicators of Infection section and asked users who downloaded infected mods to scan the JAR file.
Image credit: KateV28 /Shutterstock.com
