Fractureiser: the virus injected into real CurseForge and Bukkit mods

Fractureiser is a virus that was injected in 2023 into real mods and plugins uploaded to CurseForge and BukkitDev. An infected jar downloads a program from the internet that steals accounts and browser passwords, starts with the computer and infects the other jars it finds.

First analysed : 2023-06-07

How it spreads

• Attackers took over creator accounts and uploaded infected versions of real mods and plugins.
• Old infected copies can still circulate on re-upload sites and in modpacks.

What it does

• A small injected method (a name like _1685f49242dd46ef9c553d8af1a4e0bb) loads a class called Utility from the internet and runs it.
• The next stages steal Minecraft, Discord and browser credentials, replace crypto addresses in the clipboard, start with Windows or Linux and inject themselves into other jar files.

How DonutScan detects it

• Spots the injected method that loads code from the internet, and the known addresses and file names.
• Shows a “Fractureiser” tag next to the verdict.

If you ran it

• Delete the infected jars and check for libWebGL64.jar, lib.dll and the microsoft-vm-core file, or reset the PC.
• From another device, change your Microsoft, Discord and mail passwords.

Indicators of compromise

Other families :Silent Net CasinoRigger WeedHack Stargazers