Silent Net: Minecraft account stealer disguised as a Fabric mod

Silent Net is a Minecraft account stealer that spreads as fake Fabric mods, most often a fake cracked “Krypton” client shared on Discord. It steals your session token and game logs, finds its server through the Polygon blockchain and installs a hidden program on Windows.

First analysed : 2026-11-06

How it spreads

• Shared as a “cracked” paid client (for example a file named kryptonV2cracked.jar) in Discord DMs, servers and voice chats.
• Inside, it is an empty mod called “Library” (mod id library) with a few classes and a large encrypted file.

What it does

• Reads your Minecraft username, UUID and session token through reflection, and your latest.log.
• Finds the address of its server by calling a smart contract on the Polygon blockchain (eth_call through public RPC nodes), so the server cannot easily be blocked.
• Downloads a PNG image that hides a Python runtime and the real stealer, unpacks it and runs it.
• Copies itself to %LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex and restarts outside the game, so it keeps running after you close Minecraft.
• Uses DNS over HTTPS and accepts any TLS certificate to avoid being noticed.

How DonutScan detects it

• Rebuilds the text the malware hides as arithmetic (each letter written as a sum or XOR) without running any code.
• Flags the fake net.fabric package, scrambled class names, the opaque payload file, the blockchain lookup and the session token access.
• Matches Silent Net signatures and shows a “Silent Net” tag next to the verdict.

If you ran it

• It targets Windows. On a Windows PC: change your Microsoft account password and sign out of every device on account.microsoft.com.
• Delete the jar and the NtProfileIndex folder, then run a full antivirus scan.
• Warn the people who sent or received the same file.

Indicators of compromise

Other families :CasinoRigger