Fake Minecraft Mod Deploys Myth Stealer RAT to Steal Browser Credentials and Cookies

A counterfeit Minecraft optimisation mod is installing Myth Stealer, malware that can steal browser passwords, cookies and data. Its malicious file looks useful because features work as advertised, giving players little reason to suspect a hidden threat.

The campaign exploits users seeking performance improvements from unofficial add-ons. Once installed, the fake mod starts a multi-stage infection chain that leads to a remote tool that lets its operator collect data and broadly control a Windows device.

Analyst devmihaylov identified the malware while examining samples obtained from a buyer of the commodity stealer.

devmihaylov said in a report shared with Cyber Security News (CSN) that the files initially received zero detections from VirusTotal, showing how lightly distributed threats can evade reputation-based checks.

Minecraft players remain frequent targets for malware distributors. Coverage of fake Minecraft Fabric mods showed how a harmless-looking game download can become the first step in account theft and compromise. The threat pairs a decoy with a loader designed to blend into a gaming setup.

Fake Minecraft Mod

The Java archive presents itself as a companion to a legitimate optimisation project and includes 12 working modules that change game performance settings.

A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage in the background. That approach matters because victims may see the expected optimisation behavior and conclude the download is safe.

The loader uses a large executable built around a standard runtime and brings a private Java environment, letting the payload run even where Java is not otherwise installed.

Before launching the final stage, the program displays a polished administrator-rights request resembling a normal Windows prompt.

Accepting it can give the malware greater access and helps its installation. It also contains retry logic intended to cope with security software interrupting the process.

The final component is heavily disguised to slow investigation. Its code uses reserved Windows-style names, encrypted text and obstacles that can break basic extraction tools.

This concealment, combined with an apparently genuine mod, makes a quick visual check of a download an unreliable safeguard.

Credential theft and remote control

Myth Stealer targets data stored by Chromium-based browsers and Firefox, including saved usernames, passwords, browsing records and active session cookies.

Stolen cookies can be especially damaging because they may let an attacker reuse an already authenticated web session. Readers can see why browser passwords and cookies remain valuable targets in similar data-theft operations.

The malware also collects system details, chat content, clipboard data and files, can capture screenshots or webcam material.

Its remote-control features include running commands, downloading or deleting files, managing processes and setting itself to start again after a reboot.

Researchers also found functions that could disrupt a victim. These include changing display settings, interfering with the mouse or keyboard, showing misleading full-screen messages and attempting to restrict access to security tools.

They can complicate recovery and pressure users to follow an attacker’s instructions. The operation used web-based reporting channels to receive stolen information, a technique documented in coverage of Discord webhook abuse across other malware campaigns.

Although the analysed command infrastructure was no longer responding when reported, inactive servers do not erase the risk to systems already infected.

Players should obtain mods only from trusted project pages, confirm the developer and file integrity, and avoid downloads promoted through chat links, videos or unofficial file-sharing pages.

This echoes guidance from reporting on trojanized Minecraft mod downloads, where social engineering is central to reaching players.

Anyone who installed a suspicious mod should remove it, run a full security scan and change passwords from a clean device.

They should also sign out of important accounts to invalidate sessions, review browser extensions and look for unfamiliar programs that start automatically. An unexpected administrator prompt during mod installation is a serious warning sign.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	2003869ed68eaa053f63bf6a5093050f52d520da877c017a4f62658000bba2a3	MythStealer.jar stage-one dropper
SHA-256	38789d9ac5f8cad13f510bc9d0e47809777bef913f329a9f526a11d33aeca09d	DiscordNitroGenerator.exe stage-two container
SHA-256	bd4eb81a12526daa040ceccc14135006dfd9792e7c21ec5fab9c2cb0400f6718	client.jar, Myth Stealer 3.2-FIX payload
File name	MythStealer.jar	Counterfeit Minecraft mod and stage-one dropper
File name	DiscordNitroGenerator.exe	Stage-two Node.js-based container
File path	%APPDATA%\Microsoft\Windows\javaw.exe	Dropped stage-two executable
File path	%TEMP%\webcam-<timestamp>.jpg	Webcam-capture output
File name	sqlitejdbc.dll	Native library loaded from the temporary directory
File name	jnidispatch.dll	Native library loaded from the temporary directory
URL	hxxp[://]ip-api[.]com/json/?fields=query,countryCode	Host geolocation lookup
URL	hxxps[://]www[.]dropbox[.]com/scl/fi/tvvsyk7x5kkbdfyuw7zh7/DiscordNitroGenerator	Second-stage download location
IP address	146[.]19[.]191[.]11	Command-and-control infrastructure
URL path	hxxp[://]146[.]19[.]191[.]11/s	Command server-list endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/t	Telemetry endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/l	Upload endpoint
URL	hxxp[://]146[.]19[.]191[.]11/api/injection	Discord injection-script endpoint
Domain	ays[.]gamepazarin[.]com	Backup command-and-control domain
URL	hxxps[://]canary[.]discord[.]com/api/webhooks/1545915606111625276/LwbwHWZBbQTP	Stage-one reporting webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291391826034944/xXOpsSG_GM0Hvf74rKbqw	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291402403942472/Let5i1nhtIG1cScI3vJmp	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291404757078189/NI-dMuvT_02i7Ee-HgX3v	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406283935865/GIRbMQaDzYFV1qH95IxAo	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406795509872/Qxjec0dl9zszu2giJYC3R	Embedded exfiltration webhook
Registry value	HKCU\...\Policies\System\DisableTaskMgr	Disables Windows Task Manager
Registry path	HKCU\Control Panel\Cursors	Used for cursor replacement
Registry path	HKCU\Software\Microsoft\ColorFiltering	Used for screen-colour inversion
Product identifier	mythkg-exe 2.21	Launcher product name and version
Build identifier	myth-gee9ute7hb	Build identifier embedded in payload
C2 keys	rawr, owo, uwu	Obfuscated server-list configuration keys

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.