Cybersecurity researchers have uncovered a fake Minecraft optimisation mod that steals browser passwords, payment-card data, cookies, Discord information, and system details while giving attackers remote control over infected Windows PCs.
The malicious Java Archive (JAR) pretends to be Lithium Extras 0.15.0+mc1.21.1, a companion mod for the legitimate CaffeineMC Lithium performance mod.
It appears convincing because 12 of its 13 modules perform real optimisation functions, including memory trimming and entity culling. However, a hidden module silently starts the malware infection chain.
After an eight-second delay, the fake mod checks the victim’s geolocation, collects the computer name, and downloads a 169 MB executable to %APPDATA%\Microsoft\Windows\javaw.exe.
The filename and folder are designed to look harmless on systems where Minecraft players commonly use Java. The downloaded file is disguised as a Node.js executable called DiscordNitroGenerator.exe.
It carries a private Java runtime and the final payload, Myth Stealer 3.2-FIX. This approach lets the malware run even if Java is not installed on the victim’s computer.
At the time the samples were submitted, both the malicious JAR and the second-stage executable had zero detections on VirusTotal.
Fake Minecraft Mod Backdoor
Before launching the final payload, the malware displays a fake administrator message asking users to approve a Windows User Account Control (UAC) prompt. The dialog uses a dark title bar and system-like wording to appear legitimate.
If the victim accepts, Myth Stealer gains higher privileges and begins collecting sensitive data. The malware can steal:
- Saved passwords, cookies, browsing history, and payment cards from Chromium- and Firefox-based browsers
- Discord tokens and chat-related data through Discord injection features
- Clipboard content, screenshots, webcam images, and selected files
- Hardware details, including BIOS serial numbers, motherboard data, CPU, GPU, and device UUIDs
- Installed apps, drivers, running processes, network connections, and antivirus details
The payload sends stolen information through Discord webhooks and attacker-controlled command-and-control servers.
Researchers identified an IP-based server at 146[.]19[.]191[.]11 and a backup typosquatted domain, ays[.]gamepazarin[.]com, impersonating the Turkish game marketplace GamePazari.
Myth Stealer is more than an information stealer. It includes remote access capabilities that allow attackers to execute PowerShell commands, download and run additional files, delete data, search directories, and maintain startup persistence.
The tool also includes defence-evasion functions such as AMSI bypass, ETW patching, process hollowing, fileless execution, virtual-machine checks, and debugger detection, medium said.
Notably, it contains a harassment command set that can disrupt victims by moving the mouse, disabling the keyboard, shaking or rotating the screen, hiding the taskbar, changing wallpaper, displaying random pop-ups, inverting colours, and replacing cursor icons.
It can also show fake Windows Update and DirectX error screens to confuse users and hide malicious activity.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
