ATLauncher

How we got this result

1. Files checkedWe compare the fingerprint and the content of each file with the malware we and others have found, and look at what is inside it.5 of 5 official filesLast checked on 3 Nov 2026
2. Deep checkOur own tools read the code of each current file and look for what harmful code does, like stealing logins or running hidden programs.3 of 5 official filesLast checked on 3 Nov 2026
3. Passed Nothing harmful found in its 5 official files.Our checks look for known signs of harm. They cannot prove that a file is harmless.

At a glance

Download

Official files for Windows, macOS and Linux, and one file for every system.

Fake sites

1 fake site found.

Privacy

Sends data. It sends usage data and data we could not identify.

Releases

Latest release on 19 Sep 2026.

Source and links

Source code

Public on GitHub

Official site

atlauncher.com

Official site

1 site uses its name to give other files. See Fake sites

Download page

atlauncher.com/downloads

Newest version

3.4.41.3, released on 19 Sep 2026

What we checked

A launcher runs on your computer like any program, and it downloads the game and its mods, so harmful code in it can steal your accounts or files.

Files checkedEach official file is downloaded on a separate machine, opened with every file inside it and never run. ClamAV, a free antivirus, and our YARA rules look for known signs of harm in all of it.

5 of its 5 official files, with every file inside them.Last checked on 3 Nov 2026

Deep checkOur own tools read the Java code in the files and look for what harmful code does, like stealing logins or running hidden programs. They read Java code only.

3 of its 5 official files. 2 hold no Java code: programs made for one system.

Same as listedA fingerprint of the file. The same fingerprint means the same file, byte for byte.

Every file we checked has the SHA-256 that the maker gives.

Older releases

6 official files of 2 older releases, every one checked.

What we found

What its Java code can do. None of this is harmful by itself: many launchers and mods do the same.

Names places that start programs at login

Names a place that starts programs when you log in to your computer. The Startup folder is named by the fractureiser detector built into ATLauncher (me.cortex.jarscanner, called by scanForFractureiser in its public source code, read on 2 Nov 2026): it looks for the places that malware uses, to warn you.

Matches a public security report

Contains an address, name or code that a public security report links to a past attack. The fractureiser file name libWebGL64.jar is in the same detector: ATLauncher looks for it in your mods to find that malware, as its public source code shows (read on 2 Nov 2026).

Can connect to the internet

It has code that can go online, for example to check for updates, sign you in or download the game. What it sends is in Privacy.In all 3 files whose Java code we read

Accepts connections from other computers

The code references server sockets or an embedded web server. Used by some tools for local web interfaces, profilers, or LAN features.In 2 of the 3 files whose Java code we read

An archive has a misleading name

A file is a zip or Java class data although its name says otherwise. Some file formats do this on purpose.In 2 of the 3 files whose Java code we read

Can download and run new code

One class references both network APIs and class loading. This is the pattern of auto-updating loaders, but also of some harmful programs. Only the source of the downloaded data tells which.In 2 of the 3 files whose Java code we read

Can run scripts

References JavaScript, Groovy, Lua or similar engines. Programs use them for settings, add-ons or their interface.In 2 of the 3 files whose Java code we read

Contains code made for your system

Native libraries (.dll, .so, .dylib) run outside the Java sandbox. Used for speed, compression, audio, graphics or database engines.In 2 of the 3 files whose Java code we read

Contains programs or scripts

The archive contains files such as .exe, .bat or .sh. They are listed with their size, format and sha256, never run. Libraries such as JavaCPP (ffmpeg.exe), LWJGL or JNA bundle them by design, so this is worth knowing but not a warning by itself.In 2 of the 3 files whose Java code we read

Creates code while it runs

The code can create or load pieces of code while it runs. Launchers load the game, its mod loaders and their own modules this way.In 2 of the 3 files whose Java code we read

Starts other programs

The code can start another program on your computer. Common reasons: opening a web link or a folder, reading hardware information, launching a helper tool.In 2 of the 3 files whose Java code we read

The evidence12

Each finding of our checks: the file, what it is in plain words, where our tools saw it, and the rule that matched.

• Names places that start programs at login
  Names a place that starts programs when you log in to your computer.In ATLauncher.app/Contents/Java/ATLauncher.jarRule: persistenceThe Startup folder is named by the fractureiser detector built into ATLauncher (me.cortex.jarscanner, called by scanForFractureiser in its public source code, read on 2 Nov 2026): it looks for the places that malware uses, to warn you.
  Judged information
• Matches a public security report
  Contains an address, name or code that a public security report links to a past attack.In ATLauncher.app/Contents/Java/ATLauncher.jarRule: known_indicatorsThe fractureiser file name libWebGL64.jar is in the same detector: ATLauncher looks for it in your mods to find that malware, as its public source code shows (read on 2 Nov 2026).
  Judged information
• Names places that start programs at login
  Names a place that starts programs when you log in to your computer.In ATLauncher.jarme.cortex.jarscanner.Detector Windows Startup folder: string "Microsoft\Windows\Start Menu\Programs\Startup"Rule: persistenceThe Startup folder is named by the fractureiser detector built into ATLauncher (me.cortex.jarscanner, called by scanForFractureiser in its public source code, read on 2 Nov 2026): it looks for the places that malware uses, to warn you.
  Judged information
• Matches a public security report
  Contains an address, name or code that a public security report links to a past attack.In ATLauncher.jarme.cortex.jarscanner.Detector fractureiser: stage 2 file name on Windows - string "libWebGL64.jar" [specific] source: https://github.com/fractureiser-investigation/fractureiser (docs/tech.md)Rule: known_indicatorsThe fractureiser file name libWebGL64.jar is in the same detector: ATLauncher looks for it in your mods to find that malware, as its public source code shows (read on 2 Nov 2026).
  Judged information
• Names places that start programs at login
  Names a place that starts programs when you log in to your computer.In ATLauncher-3.4.41.1.jarme.cortex.jarscanner.Detector Windows Startup folder: string "Microsoft\Windows\Start Menu\Programs\Startup"Rule: persistenceThe Startup folder is named by the fractureiser detector built into ATLauncher (me.cortex.jarscanner, called by scanForFractureiser in its public source code, read on 2 Nov 2026): it looks for the places that malware uses, to warn you.
  Judged information
• Matches a public security report
  Contains an address, name or code that a public security report links to a past attack.In ATLauncher-3.4.41.1.jarme.cortex.jarscanner.Detector fractureiser: stage 2 file name on Windows - string "libWebGL64.jar" [specific] source: https://github.com/fractureiser-investigation/fractureiser (docs/tech.md)Rule: known_indicatorsThe fractureiser file name libWebGL64.jar is in the same detector: ATLauncher looks for it in your mods to find that malware, as its public source code shows (read on 2 Nov 2026).
  Judged information
• Names places that start programs at login
  Names a place that starts programs when you log in to your computer.In ATLauncher.app/Contents/Java/ATLauncher.jarme.cortex.jarscanner.Detector Windows Startup folder: string "Microsoft\Windows\Start Menu\Programs\Startup"Rule: persistenceThe Startup folder is named by the fractureiser detector built into ATLauncher (me.cortex.jarscanner, called by scanForFractureiser in its public source code, read on 2 Nov 2026): it looks for the places that malware uses, to warn you.
  Judged information
• Matches a public security report
  Contains an address, name or code that a public security report links to a past attack.In ATLauncher.app/Contents/Java/ATLauncher.jarme.cortex.jarscanner.Detector fractureiser: stage 2 file name on Windows - string "libWebGL64.jar" [specific] source: https://github.com/fractureiser-investigation/fractureiser (docs/tech.md)Rule: known_indicatorsThe fractureiser file name libWebGL64.jar is in the same detector: ATLauncher looks for it in your mods to find that malware, as its public source code shows (read on 2 Nov 2026).
  Judged information
• Names places that start programs at login
  Names a place that starts programs when you log in to your computer.In ATLauncher-3.4.41.0.jarme.cortex.jarscanner.Detector Windows Startup folder: string "Microsoft\Windows\Start Menu\Programs\Startup"Rule: persistenceThe Startup folder is named by the fractureiser detector built into ATLauncher (me.cortex.jarscanner, called by scanForFractureiser in its public source code, read on 2 Nov 2026): it looks for the places that malware uses, to warn you.
  Judged information
• Matches a public security report
  Contains an address, name or code that a public security report links to a past attack.In ATLauncher-3.4.41.0.jarme.cortex.jarscanner.Detector fractureiser: stage 2 file name on Windows - string "libWebGL64.jar" [specific] source: https://github.com/fractureiser-investigation/fractureiser (docs/tech.md)Rule: known_indicatorsThe fractureiser file name libWebGL64.jar is in the same detector: ATLauncher looks for it in your mods to find that malware, as its public source code shows (read on 2 Nov 2026).
  Judged information
• Names places that start programs at login
  Names a place that starts programs when you log in to your computer.In ATLauncher.app/Contents/Java/ATLauncher.jarme.cortex.jarscanner.Detector Windows Startup folder: string "Microsoft\Windows\Start Menu\Programs\Startup"Rule: persistenceThe Startup folder is named by the fractureiser detector built into ATLauncher (me.cortex.jarscanner, called by scanForFractureiser in its public source code, read on 2 Nov 2026): it looks for the places that malware uses, to warn you.
  Judged information
• Matches a public security report
  Contains an address, name or code that a public security report links to a past attack.In ATLauncher.app/Contents/Java/ATLauncher.jarme.cortex.jarscanner.Detector fractureiser: stage 2 file name on Windows - string "libWebGL64.jar" [specific] source: https://github.com/fractureiser-investigation/fractureiser (docs/tech.md)Rule: known_indicatorsThe fractureiser file name libWebGL64.jar is in the same detector: ATLauncher looks for it in your mods to find that malware, as its public source code shows (read on 2 Nov 2026).
  Judged information

What we checked

A launcher can send information about you over the internet, such as your player name or your login.

Deep checkWe read the code and list each web address it can contact, and what it sends. We leave out code that is never used.

The Java code of all 3 files that hold some. See each file in Releases

Web addresses

api.curseforge.com: Checks for a new version of the launcher.Sends: nothing about youapi.feed-the-beast.com: Purpose not known.Sends: data we could not identify. The code sends something, but our checks cannot tell whatapi.minecraftservices.com: Talks to the Minecraft login service.Sends: data we could not identify. The code sends something, but our checks cannot tell whatapi.modrinth.com: Checks for a new version of the launcher.Sends: nothing about youlogin.microsoftonline.com: Talks to the Minecraft login service.Sends: data we could not identify. The code sends something, but our checks cannot tell whatmeta.fabricmc.net: Checks for a new version of the launcher.Sends: data we could not identify. The code sends something, but our checks cannot tell whatuser.auth.xboxlive.com: Talks to the Minecraft login service.Sends: data we could not identify. The code sends something, but our checks cannot tell whatxsts.auth.xboxlive.com: Talks to the Minecraft login service.Sends: data we could not identify. The code sends something, but our checks cannot tell whatAddress built while it runsThe code builds this address while it runs, so it is not written in the file.: Connects to game servers or other players. Sends usage statistics.Sends: data we could not identify. The code sends something, but our checks cannot tell what

Also named in its codeAddresses written in its code that no code we read contacts: a link shown to you, a default setting, or code we could not follow.

2.5.29.172.5.29.19api.atlauncher.comapi.technicpack.netatl.pwatlauncher.comcdn.atlcdn.netcrowdin.comfiles.minecraftforge.netgithub.comlaunchermeta.mojang.comlibraries.minecraft.netlogging.apache.orgmaven.fabricmc.netmaven.legacyfabric.netmaven.minecraftforge.netmaven.neoforged.netmaven.quiltmc.orgmodrinth.compaste.atlauncher.comresources.download.minecraft.netsentry.iowww.curseforge.comwww.freedesktop.orgwww.microsoft.comwww.minecraft.netxml.apache.org

How to know the official site

Official site

atlauncher.com

Files come from

atlauncher.com

SHA-256A fingerprint of the file. The same fingerprint means the same file, byte for byte.

ATLauncher-setup-1.3.0.0.exe4ac8068c83e84b9c9c09dcad37120ed4041e72480c4e9a36543445dcb78432d2Every official file and its SHA-256, in Releases

The 1 fake site we foundChecked on 2 Nov 2026

Of these, it gives a file with malware. Sites in one fold share their pages and their download.

If you downloaded a file from one of these sites

1. Drop the file in the Scanner. It tells you if it is an official file of ATLauncher or a file of these sites.
2. If it is not an official file and you have not opened it, delete it.
3. If you opened it: run a full scan with your antivirus. On Windows, the built-in one is Microsoft Defender, in the Windows Security app.
4. If you signed in to the launcher it installed: use "sign out everywhere" in your Microsoft security settings and change your Microsoft account password.
5. Get ATLauncher from its official site, atlauncher.com .