Loading story…
A counterfeit Minecraft optimization mod posing as a companion to the legitimate Lithium project has been used to infect Windows users with Myth Stealer 3.2-FIX, an information stealer and remote-access trojan. The malicious Java archive retains 12 working optimization modules to appear credible but embeds a concealed thirteenth loader that fingerprints the host and launches a multi-stage payload chain, including a Node.js-based second stage named DiscordNitroGenerator.exe.
Myth Stealer can collect browser credentials, cookies, history, system and chat data, clipboard contents, local files, screenshots, and webcam captures, while enabling persistence, remote command execution, and disruptive actions. The campaign used Dropbox to host second-stage payloads, Discord webhooks for reporting and exfiltration, and infrastructure including 146[.]19[.]191[.]11 and ays[.]gamepazarin[.]com; the analyzed command-and-control server was offline at the time of reporting. Analyst devmihaylov reported that initial samples obtained from a commodity-stealer buyer had no VirusTotal detections.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
A counterfeit Minecraft optimization mod masquerading as a companion to the Lithium project was identified delivering a multi-stage Myth Stealer 3.2-FIX infection chain to Windows users. The malware steals browser credentials and cookies, system and user data, screenshots and webcam captures, and provides remote execution, persistence, and disruptive functions; the analyzed C2 infrastructure was offline when reported.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Brazilian cybercrime group **LofyGang** has resurfaced after more than three years with a malware campaign aimed at Minecraft players, distributing a new infostealer known as **LofyStealer** or **GrabBot** through a fake cheat tool called **"Slinky."** Researchers linked the activity to LofyGang through code artifacts, infrastructure, and command-and-control branding, and said the lure uses the official Minecraft icon and social engineering to trick users into launching the malware. The campaign reflects a shift from the group’s earlier npm typosquatting and software supply-chain activity toward a broader **malware-as-a-service** operation. The infection chain uses a JavaScript or Node.js-based loader to deploy a native payload in memory as `chromelevator.exe`, where it injects into live browser processes to evade conventional antivirus and EDR visibility. The stealer targets at least eight major browsers and harvests cookies, passwords, session tokens, payment card data, and IBANs before compressing and exfiltrating the data to **`24.152.36.241:8080`**. Researchers said the operation includes **Free** and **Premium** tiers, a victim dashboard, and a custom builder called **Slinky Cracked**, while also highlighting the wider abuse of trusted platforms such as GitHub, Reddit, and search results to spread malware through fake repositories, bogus alerts, and gaming-cheat lures.
Jun 29, 2026
Malicious websites impersonating **Minecraft** clients, mods, and related tools are continuing to distribute the **WeedHack** malware family despite prior command-and-control disruption. McAfee Labs identified at least 10 active sites and multiple file-hosting accounts tied to the campaign, while McAfee WebAdvisor blocked more than 6,300 attempts to reach them in the past month. The lures are amplified through **SEO poisoning**, YouTube links, Discord, GitHub repositories, and trusted Minecraft community platforms, with attackers using convincing lookalike pages to trick gamers into downloading malicious files. The infection chain delivers Java `JAR` payloads that collect system information, add Microsoft Defender exclusions, and steal credentials, browser data, cookies, and cryptocurrency wallets from infected hosts. Earlier reporting linked the Malware-as-a-Service operation to at least 116,464 infected systems and 2,000 to 3,000 new victims per day, while researchers said the operators used **EtherHiding** to retrieve active server addresses from the Ethereum blockchain and keep the campaign resilient after takedowns. One spoofed site was reportedly built with the AI website builder **Lovable**, underscoring how easily attackers can create realistic malware-delivery infrastructure.
Aug 27, 2026
McAfee researchers reported that the **WeedHack** malware-as-a-service operation has infected more than **116,000 systems** by targeting Minecraft players with trojanized mods, clients, cheats, and utilities. The campaign has been active since at least January and is spreading through **YouTube videos**, gaming forums, and **SEO-poisoned** websites that mimic legitimate mod-download pages, often borrowing trust signals such as links to real GitHub repositories and Discord servers. Researchers tracked more than **3,820 malicious JAR files**, over **240 distribution URLs**, and infection volumes of roughly **2,000 to 3,000 systems per day**, with the largest victim concentrations in the **United States, Germany, India, and the UK**. WeedHack is operating openly on the clear web with a free dashboard for viewing stolen data and building payloads, while a premium tier priced at about **$5 per month** adds remote-access and surveillance features. The malware steals **Minecraft session IDs**, browser cookies and passwords, cryptocurrency wallet data, and credentials for services including **Discord, Steam, and Telegram**; paid users can also gain **webcam access, keylogging, reverse shell, screen sharing, and file-management** capabilities. McAfee said the Java-based, multi-stage malware uses **Ethereum-based C2 discovery**, persistence, and Windows Defender evasion, and observed that many customers in its 800-plus-member Telegram community appear to be teenagers or young adults using the service for account theft, harassment, cyberbullying, and webcam spying.
Jun 29, 2026