Fractureiser Malware Targets MineCraft

Researchers are warning the Minecraft gamers about a rapidly spreading multi-stage malware campaign dubbed as Fractureiser targeting modpacks and plugins.

Several CurseForge and Bukkit accounts have been compromised and used to publish malware-rigged updates of mods and plugins without the original author’s knowledge. These mods have then been included in popular modpacks that have been downloaded in millions.

Mods are user-created add-ons that extend the gameplay, collections of which are put together and configured in the form of modpacks. CurseForge and Bukkit are two of the largest Minecraft mod repositories.

Advertisements

The Fractureiser malware is downloaded in four stages, labelled zero through to three. Stage three brings the final payload in the form of a JAR file that includes a native binary named hook.dll. It currently affects Linux and Windows Minecraft installs and attempts to propagate itself to all JAR files on the system, including those that are not part of a Minecraft mod.

Upon modification of the file, the malware can target victims in a range of ways. Firstly, it can hijack cryptocurrency transactions by swapping wallet addresses with the attackers. Fractureiser can also steal cookies and user credentials from web browsers and exfiltrate authentication tokens for Discord, Microsoft, and Minecraft.

Researchers highlighted it is aimed at mod or plugin developers, since the stage three malware targets Windows Sandbox, the only virtualization environment that allows alteration of the host clipboard contents when the virtual machine is running in the background.

This research was documented by researchers from BItDefender

Indicators of Compromise