Minecraft players warned of mods stealing passwords & personal data

A new Minecraft report has highlighted a “malicious” campaign that targets mods to steal all sorts of personal information.

There’s a reason why the Minecraft community is still thriving nowadays, despite the game being over a decade old. With creative freedom, there’s just so much you can do. Not to mention, installing mods can help make the experience even more exciting as they provide more depth to the gameplay.

While that’s the case, however, players should take extra caution when it comes to downloading mods. As investigated by Check Point Research, there’s been a large-scale, malicious campaign that targets Minecraft mods, which can lead to whoever installs these getting their Windows devices infected.

Once that happens, they could risk getting their credentials, authentication tokens, cryptocurrency wallets, and other important data stolen.

Minecraft players risk getting their personal data stolen from fake mods

Check Point Research’s discovery highlights “malicious repositories distributing malware” conducted by the Stargazers Ghost Network, which uses the Minecraft modding system as well as GitHub to reach a large audience of victims.

According to the report, the malware distributed impersonated “Oringo and Taunahi”, which are scripts or cheats. Both the first and second stages are developed in Java and can only be executed if the Minecraft runtime is installed on the host machine,” they explained.

These files would then pull off a “multi-stage attack” to compromise systems and steal personal data from victims.

Check Point Research has also been working since March 2025 to track these “malicious GitHub repositories.” These would not only appear “legitimate,” but they would also be “undetected by all antivirus engines across VirusTotal, as it is highly targeted for Minecraft users.”

So, what happens in the worst-case scenario, assuming that these end up running in one’s system? Their report provided a long list of all the data that could be stolen ranging from browser logins, cryptocurrency wallets, private messages through Discord, and so much more.