Stargazers: fake Minecraft cheat mods on GitHub that load a stealer

Stargazers is a campaign of fake Minecraft cheat mods (Oringo, Taunahi, Polar, Skyblock Extras…) posted on GitHub and boosted with fake stars. The mod checks it is not being analysed, fetches a link from Pastebin and loads a Java stealer, then a Windows stealer that takes browser passwords, Discord and crypto wallets.

First analysed : 2025-06-18

How it spreads

• GitHub repositories with fake stars, offering cracked cheat clients and Skyblock mods.

What it does

• Checks for virtual machines and analysis tools (Wireshark, VirtualBox…) and stays quiet if it finds one.
• Reads a Base64 link from Pastebin and loads MixinLoader into memory, which steals Minecraft, Discord and browser data and downloads a .NET stealer.

How DonutScan detects it

• Recognises its Pastebin link, server address and package names, and flags the anti-analysis checks.
• Shows a “Stargazers” tag next to the verdict.

If you ran it

• From another device, change your Microsoft, Discord and mail passwords and sign out everywhere.
• Run a full antivirus scan, or reset the PC.

Indicators of compromise

Other families :Silent Net CasinoRigger WeedHack Fractureiser