Fake Minecraft Mod Drops Myth Stealer RAT to Steal Passwords and Remotely Control PCs

A trojanized Minecraft optimization mod posing as a companion to the legitimate Lithium project has been used to deploy Myth Stealer 3.2-FIX, a password-stealing malware family with remote-access, surveillance, persistence, and victim-harassment capabilities.

The malicious archive, tracked as MythStealer.jar_, masquerades as Lithium Extras 0.15.0+mc1.21.1 by “soder.” It abuses the reputation of CaffeineMC’s legitimate Lithium performance mod, an open-source project designed to improve Minecraft performance.

The counterfeit manifest even references the genuine Lithium project, helping it appear legitimate in mod menus and during casual inspection.

Unlike many malicious game mods, the JAR does not immediately expose its intent.

Twelve of its 13 modules perform expected optimization-related functions, including memory trimming, entity culling, and configuration creation.

The hidden thirteenth component delays execution for eight seconds, queries ip-api[.]com for the victim’s public IP address and country code, collects the hostname, and downloads a secondary executable from Dropbox.

The downloaded file, named DiscordNitroGenerator.exe, is written to %APPDATA%\Microsoft\Windows\javaw.exe a path and filename selected to blend into systems where Java is commonly used for Minecraft.

The first-stage dropper also reports infection progress to a Discord webhook and re-downloads the payload if it is missing or smaller than 50 MB.

At intake, both the Java archive and the 169 MB executable reportedly returned zero detections on VirusTotal. The use of a newly created Discord webhook and ordinary-looking game-mod functionality likely contributed to the campaign’s initial evasion.

Its embedded assets include the Myth Stealer Java payload, a trimmed private Java runtime, a native elevation helper, and V8 bytecode.

Bundling a private JDK allows the attackers to launch the final Java malware even on systems without Java installed.

The loader extracts the runtime, locates javaw.exe, and starts the stealer with the -noverify option, disabling Java bytecode verification and allowing malformed, heavily obfuscated classes to execute.

Before launching the payload, the loader displays a fake administrator-style message instructing the victim to accept a UAC prompt.

The social-engineering dialog is implemented through PowerShell WinForms and styled to resemble a native Windows prompt.

Code references including runPowershellElevation, runWscriptElevation, and retryOnAvLock show that the loader attempts elevation through several paths and expects endpoint-security interference.

Medium Researchers said that, the campaign hides its malicious activity behind a working mod, a fake Node.js-based launcher, a bundled Java runtime, and a convincing Windows elevation prompt.

Fake Minecraft Mod Drops

Myth Stealer 3.2-FIX is built as a Java information stealer and remote-access tool. Its 251 classes sit inside a package named complexer/NUL, abusing the Windows reserved device name NUL to disrupt extraction tools and decompilers.

The payload can steal:

Data type	Targeted information
Browser credentials	Saved usernames and passwords
Payment data	Cardholder names, card numbers, expiration dates, and CVVs
Browser sessions	Cookies, browsing history, and profiles
System details	Hostname, hardware ID, operating-system information
Chat data	Captured messages, timestamps, and senders
Local files	Search, collection, deletion, and ZIP-based exfiltration

The malware includes code for Firefox/Gecko credential decryption through NSS functions such as NSS_Init and PK11SDR_Decrypt.

It also targets Chromium browsers using DPAPI and app-bound encryption-related APIs, including NCryptDecrypt, token impersonation functions, and cryptUnprotectData.

The large executable is not a conventional compiled payload. It is a stock node.exe binary identified as Node.js 26.5.1 containing a 66.6 MB overlay built with pkg.

It collects hardware identifiers through WMI queries for BIOS serial numbers, baseboard serial numbers, system UUIDs, CPU details, and GPU information.

Researchers recovered two command-and-control configurations: a bare IP address, 146[.]19[.]191[.]11, and the domain ays[.]gamepazarin[.]com.

The domain appears to imitate gamepazari[.]com, a Turkish game marketplace, by adding an extra letter.

The /s endpoint supplies the active server list, while /t handles telemetry and /l is used for uploads. The payload then connects to its actual control server through a custom Netty-based TCP protocol.

Although the malware does not use TLS, it encrypts its traffic with an RSA-OAEP-protected AES-GCM session key and subsequent AES-GCM frames.

ThreatFox lists the recovered Myth Stealer C2 endpoints and notes the /api/injection path used to retrieve a Discord injection script.

The malware also contains five hard-coded Discord webhooks for exfiltration, while the stage-one dropper uses a separate sixth webhook.

Operator command set includes process hollowing, fileless execution, AMSI bypass, ETW patching, antivirus detection, browser-session manipulation, webcam capture, clipboard theft, screenshot collection, file deletion, persistence, and raw remote control of the mouse and keyboard.

The RAT’s most unusual functions are explicitly designed to disrupt or intimidate victims.

Commands include cursor replacement, screen rotation, screen shaking, inverted colors, taskbar hiding, random pop-ups, wallpaper loops, mouse swapping, optical-drive control, volume changes, fake Windows Update screens, and a fabricated DirectX device-error display.

It can also set the DisableTaskMgr registry value to block Task Manager, potentially preventing users from quickly identifying or terminating malicious processes.

Users can also statically inspect suspicious JAR files with services such as RAT Scanner, which is designed to identify malicious Minecraft mods, stealers, loaders, and RAT behavior.

Anti-analysis logic checks JVM arguments for debugging tools, records virtualization signals, and can terminate execution if it identifies an analysis environment.

Minecraft players should download mods only from trusted sources such as the official Modrinth, CurseForge, or the developer’s official GitHub repository.

The campaign demonstrates how malware operators are increasingly combining functional game modifications, trusted project impersonation, legitimate runtime binaries, and social engineering to evade both players and endpoint defenses.

IOCs

SHA256	Filename
2003869ed68eaa053f63bf6a5093050f52d520da877c017a4f62658000bba2a3	MythStealer.jar
38789d9ac5f8cad13f510bc9d0e47809777bef913f329a9f526a11d33aeca09d	DiscordNitroGenerator.exe
bd4eb81a12526daa040ceccc14135006dfd9792e7c21ec5fab9c2cb0400f6718	client.jar

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.