What is this "Cute Minecraft Mod" really doing?
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A security researcher analyzes 'Meowcraft', a malicious Minecraft mod pack distributed via compromised Discord accounts. The mod ships a single JAR that downloads and executes a disguised executable (renamed javaw.exe) from the temp directory, requesting admin privileges. The payload is a Node.js infostealer that kills browsers to harvest credentials, steals Minecraft account data, and hijacks Discord accounts to propagate the campaign further. The malware uses double base64-encoded PowerShell commands for anti-analysis evasion, yet the code itself is barely obfuscated. Windows Defender and most AV tools missed it on first run. The researcher also notes that Windows' lack of application-level sandboxing for sensitive data (unlike macOS's keychain) makes this class of attack trivially easy to execute without kernel access.