Minecraft Mods and the Malware That Hid Inside Them

By Kim Njuki October 17, 2026 Updated: October 17, 2026 3 min read

Minecraft modding is one of the biggest software ecosystems in gaming, and it has been used twice in recent years to spread serious malware. Both incidents are worth understanding, because they were not the usual "random download from a shady site" — one hit the most trusted mod platform in the space.

Fracturiser: malware inside CurseForge itself

In June 2023, dozens of mods and plugins on CurseForge and the Bukkit plugin site were found to contain a multi-stage infostealer called Fracturiser. Ars Technica reported that the platform advised users to immediately stop downloading or updating mods. The attack worked by compromising CurseForge and Bukkit developer accounts and injecting malicious code into existing projects — which then trickled into popular modpacks like "Better Minecraft," which had over 4.6 million downloads, according to BleepingComputer.

What Fracturiser did, per Bitdefender's analysis, is the standard infostealer playbook: it stole Minecraft and Discord authentication tokens, browser cookies and saved logins, and tried to inject itself into every other .jar file on the system. It was a genuine supply-chain attack — the infected files were hosted on the official platforms, not a torrent site.

BleedingPipe: a bug that ran code on servers and players

A month later came a different kind of threat. BleedingPipe was a remote code execution vulnerability caused by unsafe deserialization in the ObjectInputStream Java class, used by many Minecraft mods to exchange network packets. BleepingComputer reported that attackers sent crafted packets to vulnerable modded servers to take them over, then used those servers to hit the players connecting to them — stealing Discord and Steam session cookies. The affected mods included EnderCore, LogisticsPipes, BDLib, and a dozen others, and the fix was simply updating to patched releases.

What this means for how you download mods

The lesson is not "never use mods." It is that the mod's platform and the mod's version both matter:

• Download from official, reviewed sources — CurseForge, Modrinth, or the mod author's own repository — and even then, only install the latest patched release. The Fracturiser incident proves even trusted platforms get compromised, which is why keeping the platform's own security guidance current matters.
• Update mods when a vulnerability is announced. BleedingPipe was fixed by mod updates; anyone running the old versions stayed exposed.
• Treat modded servers the way you would any software: if a server is running vulnerable mods, it can be turned against the players on it.

The defence is the same one that applies everywhere else in gaming security: keep everything updated, and do not run a file you cannot trace back to a source you trust.

Sources

• Ars Technica — Dozens of popular Minecraft mods found infected with Fracturiser malware
• BleepingComputer — New Fractureiser malware used CurseForge Minecraft mods to infect Windows, Linux
• BleepingComputer — Hackers exploit BleedingPipe RCE to target Minecraft servers, players
• Bitdefender — Infected Minecraft Mods Lead to Multi-Stage, Multi-Platform Infostealer Malware