Six Minecraft mods on Modrinth carried a hidden download that installs a password-stealing browser extension

Modrinth

Six small mods, published by accounts created minutes earlier, secretly downloaded a second program that adds a hidden extension to Chrome, Edge, Opera, Opera GX and Brave.

What it sends:

If you installed one of them

  1. Remove the mod from your mods folder.
  2. In each browser (Chrome, Edge, Opera, Opera GX, Brave) and each profile, open the extensions page, remove any extension you did not install, and turn developer mode off.
  3. Most home computers can skip this step. On a school or work computer, before you delete the folders below, double-click the .reg file in C:\ProgramData\ChromeDevAssist\policy-backup-* to restore the browser settings the malware removed.
  4. Close the browsers, then delete the folders %LOCALAPPDATA%\ChromeDevAssist and C:\ProgramData\ChromeDevAssist, and the file %LOCALAPPDATA%\Microsoft\Windows\Explorer\iiconcache_widemod_2560.db.
  5. Run a full scan with your antivirus.
  6. Use "sign out everywhere" in the security settings of your accounts, such as Microsoft and Discord. Change every password you typed in your browser since you installed the mod, and turn on two-factor authentication (2FA).
  7. If you typed card details into a website since you installed the mod, contact your bank.

You can check your other mods with the Scanner.

Who found what

What happened

Between 31 May and 24 June 2026, six new Modrinth accounts each published one small mod, between 1 and 35 minutes after the account was created. Each mod was first released as version 1.0.0, without the hidden download. One to seven days later, version 1.0.1 added it. In five of the six mods, version 1.0.1 kept the same file name as 1.0.0. The mods stayed online until 27 October 2026.

How it works

  1. When the game starts, the mod asks https://www.today.coffee/getupdate for an "update". This looks like an ordinary version check.
  2. The reply is a Java program encoded as text (Base64). The mod saves it to a temporary file, loads it into the game and runs it. It computes two checksums of the reply (SHA-1 and CRC32) but never compares them with anything, so whatever program the site sends will run.
  3. At a random moment, and only once, the program closes Chrome, Edge, Opera, Opera GX and Brave. It then adds its extension to every browser profile and turns on developer mode. To do this, it changes the browser's settings and gets around the check that protects them. In Edge it also starts the browser off-screen to load the extension. If a browser policy blocks developer mode, it saves a copy of that policy and then deletes it, asking for administrator rights if needed. It adds nothing to Windows start-up or scheduled tasks.
  4. The extension runs on every site you visit. It records what you type into forms on those sites, including passwords, 600 ms after you stop typing. It also sends each site's cookies (including the session cookies that keep you signed in), each site's local storage, the pages you visit, your public IP address and location (which it looks up with freeipapi.com), and a fingerprint of your computer. It encrypts this data and sends it to https://www.today.coffee/api/entries, when it is installed, every time the browser starts, and at regular intervals. It can also read a new server address from a file on GitHub.

Firefox is not targeted.

The six mods

We found no malware in the 1.0.0 files of any of the six mods.

Technical details (for security researchers)

SHA-1 of the 1.0.1 files:

Second stage and extension:

Actions taken

More