--- title: "What is this \"Cute Minecraft Mod\" really doing?" url: https://daily.dev/posts/what-is-this-cute-minecraft-mod-really-doing--fh58a2auh source_url: https://www.youtube.com/watch?v=2x-J6wK3z20 type: video:youtube source: "Eric Parker" published: 2026-05-28T15:21:04.637Z updated: 2026-05-28T15:21:24.227Z tags: ["malware", "powershell", "discord"] reading_time: 12 upvotes: 2 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What is this "Cute Minecraft Mod" really doing? **[Eric Parker](https://daily.dev/sources/ericparker)** · 12 min read · 2 upvotes · 0 comments ## Summary A security researcher analyzes 'Meowcraft', a malicious Minecraft mod pack distributed via compromised Discord accounts. The mod ships a single JAR that downloads and executes a disguised executable (renamed javaw.exe) from the temp directory, requesting admin privileges. The payload is a Node.js infostealer that kills browsers to harvest credentials, steals Minecraft account data, and hijacks Discord accounts to propagate the campaign further. The malware uses double base64-encoded PowerShell commands for anti-analysis evasion, yet the code itself is barely obfuscated. Windows Defender and most AV tools missed it on first run. The researcher also notes that Windows' lack of application-level sandboxing for sensitive data (unlike macOS's keychain) makes this class of attack trivially easy to execute without kernel access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#malware](https://daily.dev/tags/malware), [#powershell](https://daily.dev/tags/powershell), [#discord](https://daily.dev/tags/discord) [View this post on daily.dev](https://daily.dev/posts/what-is-this-cute-minecraft-mod-really-doing--fh58a2auh)