What the Fractureiser Malware Taught Minecraft Mod Users

In June 2023, a lot of Minecraft players learned something uncomfortable about the mods they had been installing for years. A piece of malware the community named fractureiser had been slipped into mod and plugin files on CurseForge and on dev.bukkit.org, two of the largest places people download Minecraft add-ons. Attackers got into a handful of creator accounts and uploaded infected versions of real, popular projects. Anyone who downloaded those versions, or a modpack that pulled them in, ran the malware the moment the game loaded.

No exploit was needed. No security hole in Windows or in Minecraft. The mod simply did what every Java mod is allowed to do, which is anything your user account can do. That is the part worth understanding, because it applies far beyond one incident in one game.

What fractureiser actually did

The volunteers who took the malware apart published a detailed public write-up within days, and the main points are easy to follow. The infected file carried a small loader, which the researchers called stage 0. When the game started, it reached out to a server, fetched the next stage, and that stage fetched another. The final stage was the real payload.

That payload went after things with resale value. It looked for Minecraft and Microsoft account sessions stored by launchers, Discord tokens, saved browser cookies and credentials, and cryptocurrency wallet data. It also tried to swap wallet addresses copied to the clipboard, so a payment would land in the attacker's wallet instead. And it searched the computer for other Java .jar files and tried to infect them too, which meant a single bad download could spread into every modpack folder on the drive.

On Windows, the write-up listed a folder named Microsoft Edge, with a space, inside the user's local AppData folder, holding a file called libWebGL64.jar, along with a registry entry to start it at login. On Linux, it described a hidden lib.jar under the user's .config folder and a systemd service. The names were chosen to look boring. That is normal for this kind of thing.

The command server was knocked offline quickly, which limited the damage. Still, nobody outside the attackers knows exactly how many machines ran the final stage, and I would be wary of anyone who claims a precise figure.

Why a mod is a program, not a skin

Many people think of a mod the way they think of a texture pack: some extra content the game reads. Java mods for Forge, Fabric or Bukkit are different. They are compiled code that the game loads and runs with no sandbox. A mod that adds a new kind of furnace has exactly the same permissions as your web browser or your tax software. It can read your files, open network connections and start other programs.

That is not a design flaw in Minecraft specifically. It is how most PC game modding works, and it is why big mod platforms scan uploads. Scanning helps. It did not catch fractureiser at first, because the loader was small and the dangerous part arrived later from a server. Any scanner that looks only at the uploaded file has that blind spot.

The advice that does not hold up

The most common reassurance I saw in forums afterwards was "only download from the official sites and you will be fine." That advice is good in general and it was exactly wrong this time. The infected files came from the official sites, uploaded through real creator accounts. People who followed the rule perfectly were the ones exposed.

Official sources still beat random reupload sites, which have hidden malware in Minecraft mods for years. But the source alone cannot be the whole defence. You also need to limit what a bad mod can reach, and you need a way to notice and recover if one gets through.

A sensible routine for modded games

None of this requires special software or much money. Here is the routine I would set up on a family PC where someone plays modded Minecraft.

1. Create a separate Windows user account for gaming, without administrator rights. Do not sign into your main browser, password manager or banking on that account. A mod running there cannot read cookies that do not exist.
2. Turn off automatic mod updates in your launcher. Update deliberately, and wait a few days after a new version appears unless it fixes something you need. Most poisoned uploads are noticed within that window.
3. Keep each modpack in its own launcher instance, so you know exactly which files belong to which game.
4. When a mod platform or a well-known modder posts a security notice, read it the same day and run whatever detection tool they recommend. For fractureiser, the investigators released scripts that checked for the paths listed above.
5. Use two-factor authentication on your Microsoft account and on Discord. A stolen password is far less useful to an attacker when a second code is required.

If you have not set up that second factor yet, our guide to setting up two-factor authentication walks through it account by account. The broader habits in keeping your devices secure cover the rest of a shared household PC.

If you think you ran something bad

This is the order I recommend, and the order matters. First, from a different device that you trust, change the passwords for your Microsoft account, Discord, email and anything saved in the browser on the affected PC. Changing them from the infected computer can hand the new password straight to the malware.

Second, sign out of all sessions. Microsoft and Discord both let you end sessions everywhere, and that kills any stolen tokens. Plain password changes do not always do that by themselves.

Third, deal with the machine. For a known threat with published file paths, removing those files and the startup entry may be enough, and a full scan with Microsoft Defender afterwards is cheap insurance. For anything you cannot identify, back up your documents and photos, not programs or mod folders, and reinstall Windows. It takes an evening. I have done it more than once for relatives and never regretted it.

One more point. If your password manager master password was ever typed on that machine, treat it as exposed too. Our note on why a reused master password defeats a password manager explains why that single password deserves special care.

This week, if anyone in your home plays modded games, open the launcher and switch automatic updates off. It is a two-minute change, and it gives you the one thing that would have saved most fractureiser victims: a few days for someone else to notice.