CasinoRigger: the mod that pays another player from your DonutSMP account

CasinoRigger is a backdoor built for economy servers like DonutSMP. Hidden inside a renamed PvP mod, it reads your chat and, when one specific player types a payment line, sends a real /pay from your account to that player. It also shows fake “You paid” receipts.

First analysed : 2026-11-06

How it spreads

• Shared as a mod “with cool knife animations” or under the name of a known mod (for example tacz refabricated.jar) in DonutSMP gambling voice chats and DMs.
• The jar is really a small PvP mod with the CasinoRigger code added.

What it does

• Listens to every chat message you receive.
• Waits for a payment line that names one player written into the code (“… paid you 500”, “received … from …”).
• Sends a real /pay for a large amount from your account to that player, without asking.
• Can print fake “You paid” lines on your screen, used for doctored screenshots.

How DonutScan detects it

• Finds client code that sends chat commands together with a payment pattern that contains a hard-coded player name, and shows that name.
• Flags fake payment proof classes and the mismatch between the file name and the mod inside.

If you ran it

• Remove the mod from your mods folder.
• Check your recent /pay history on the server and contact the server staff with screenshots.
• It does not steal your account login, but anything you can pay can be taken while it runs.

Indicators of compromise

Other families :Silent Net