Minecraft Malware Reports
The Minecraft mods, plugins and other projects in which our checks confirmed malware, and the fake download sites that give it. Some are still online: each row says where it is now and what its malware does. A removed mod stays on the computers of players who installed it (why it matters): if you installed one, here is what to do.
Articles
See all articles
12 fake Minecraft launcher sites install hidden remote access on Windows PCs
, Fake download sites
Twelve fake sites for the official Minecraft Launcher from Mojang, Prism Launcher and HMCL give Windows players a zip that secretly installs ScreenConnect, a remote control program.
Six Minecraft mods on Modrinth carried a hidden download that installs a password-stealing browser extension
, Modrinth
The extension records what you type into websites, including passwords and card numbers, and sends your login cookies.
We found malware in 34 Minecraft projects that were still online
, CurseForge and Modrinth
We reported them from 20 to 24 October 2026. All 34 have been removed from the platforms where we found them.
- github.com/ApparitionMayor/curseforge-appFake download site of CurseForge appOnline now. The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.Malware
Checked on 5 Nov 2026.
- github.com/Frostkurivet/prism-launcherFake download site of Prism LauncherOnline now. The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.Malware
Checked on 5 Nov 2026.
- github.com/mzqjbwfllxob/ftb-appFake download site of FTB AppOnline now. The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.Malware
Checked on 5 Nov 2026.
- github.com/Settlementpustable/atlauncherFake download site of ATLauncherOnline now. The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.Malware
Checked on 5 Nov 2026.
- github.com/spectereagleraise/modrinth-appFake download site of Modrinth AppOnline now. The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.Malware
Checked on 5 Nov 2026.
- github.com/upyxjlwjgrbc/gdlauncherFake download site of GDLauncherOnline now. The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.Malware
Checked on 5 Nov 2026.
- github.com/wzxolhqknwux/technic-launcherFake download site of Technic LauncherOnline now. The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.Malware
Checked on 5 Nov 2026.
- github.com/xrjedatuxvvu/multimcFake download site of MultiMCOnline now. The Windows file is not the launcher: it hides from test machines and installs another hidden program. The macOS button asks you to paste a command that downloads a program.Malware
Checked on 5 Nov 2026.
- hmcl.computerFake download site of HMCLOnline now. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- hmcl.infoFake download site of HMCLOnline now. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- minecraft-launcher.appFake download site of Minecraft LauncherOnline now. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- minecraftlauncher.ioFake download site of Minecraft LauncherOnline now. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- minecraftlauncher.netFake download site of Minecraft LauncherOnline now. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- minecraftlauncher.proFake download site of Minecraft LauncherOnline now. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- prism-launcher.comFake download site of Prism LauncherOnline now. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- prism-launcher.orgFake download site of Prism LauncherOnline now. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- prismlauncher.appFake download site of Prism LauncherBehind a Cloudflare warning. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- prismlauncher.ccFake download site of Prism LauncherOffline. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- prismlauncher.ioFake download site of Prism LauncherOffline. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- prismlauncher.proFake download site of Prism LauncherOffline. The setup in this zip installs a hidden remote control program: someone else can use your computer.Malware
Checked on 4 Nov 2026.
- tlauncher-download.ruFake download site of TLauncherOnline now. This file is not TLauncher: it is an installer that downloads and installs other programs. ClamAV, a free antivirus, detects it as malware.Malware
Checked on 4 Nov 2026.
For developers: the projects and fake download sites of this list are also free JSON feeds in the Modgrade API.