“Fractureiser” malware in popular Minecraft mods and modpacks
prismlauncher.org
“Fractureiser” malware in popular Minecraft mods and modpacks
1–10 of 106 posts
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#2Most up to date information here.
https://github.com/fractureiser-investigation/fractureiser
Pretty significant find. Exercise caution if you have downloaded Minecraft mod packs since at least April.
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#3This is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#4This is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.
You could play the game/mods on a burner PC or in a VM and do everything else, such as access your accounts, from a different computer.
Also would be surprised if a commercial AV like Bitdefender doesn’t pick this malware up.
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#5files-8ie,pages,dev does not resolve and 85,217,144,130 times out, so... the malware doesn't do anything anymore?
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#6This is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.
Just play vanilla for now, I guess
I thought it took a hot minute to get mods updated anyway
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#7This is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.
You could play the game/mods on a burner PC or in a VM and do everything else, such as access your accounts, from a different computer. Also would be surprised if a commercial AV like Bitdefender doesn’t pick this malware up.
There are scripts written by mod devs, and curseforge (the platform where mods are updated) to detect it, so that's useful.
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#8When the creator gets caught I hope he uses the "in minecraft" defence.
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#9This is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.
Just play vanilla for now, I guess I thought it took a hot minute to get mods updated anyway
Many smaller mods updated quickly. This is a) because this is not a very large update, and b) because Minecraft has pre releases and release candidates which are practically the same as the final release, so the mod can be updated before the final release of the version.
Also, many mods are necessary for performance reasons, due to vanilla's performance being questionable at times.
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#10client.jar searches the entire filesystem
When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable.
[1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.