Links scam findings

Real scams. Plain English.

See what a scam does before it does it to you.

Every entry here is a real file that was sent to real people. Each one comes with a step-by-step animation, a plain explanation, and a checklist for spotting the next one.

Browse the samples Test your eye
Samples analysed
3
File hashes published
5
Malicious files hosted here
0
Files run by us
0

How these attacks work

Different files, the same four stages. Once you can name them, they are much easier to notice.

  1. The lure

    A modpack, mod or "performance fix" arrives in a chat message, often from a hacked friend's account.

  2. The hidden file

    One file isn't what it claims to be: unlisted, wrongly named, or far too large for its job.

  3. The payload

    It runs when the game loads, then decodes or downloads the real malware.

  4. The theft

    Browser logins, Discord sessions and crypto wallets are copied out, and the attacker often keeps remote control.

The samples

Each page walks through one sample step by step. Plain language, no jargon, and nothing to download.

  • Danger: high
  • Dropper
  • Seen 18 Oct 2026

The modpack with one extra file

Looks like a normal CurseForge pack. One unlisted mod quietly downloads the real malware after you start the game.

Watch how it works: the modpack with one extra file
  • Danger: critical
  • Spy and remote control
  • Seen 1 Oct 2026

The fake Fabric API

A file using a popular mod's name hides an obfuscated program. Decoded, it steals accounts and reports to a Discord bot.

Watch how it works: the fake Fabric API
  • Danger: high
  • Password and wallet stealer
  • Seen 8 Oct 2026

The pack with no mods

A modpack that lists no mods but ships one large jar called "Performance Helper". It targets browser logins, Discord and crypto wallets.

Watch how it works: the pack with no mods

Spot the odd one out

Three quick rounds based on the real samples. Pick the file that doesn't belong.

Three habits that would have stopped all of these

  1. Download mods only from the official page.CurseForge and Modrinth list every file. If a "pack" arrives as a zip in a chat, treat it as unsafe.
  2. A modpack's list should match what's inside.An extra file that isn't on the list, especially one in the mods folder, is the biggest warning sign.
  3. A friend's name isn't proof.Hacked accounts send these files. Ask on a different app: "did you really send me this?"

If you already opened something

Right now

  • Disconnect from the internet and close the game and launcher.
  • From a different, clean device, change your email password first, then Discord, Steam, Microsoft and your bank.
  • Sign out of every session on every account.

Then

  • Set up two-step login again and make new backup codes.
  • Move any crypto to a brand-new wallet.
  • Back up your photos and documents, then reinstall Windows. It is the only way to be sure.

About this site

How the samples are studied

The analysis here comes from reading the files' contents, never from running them. Where a result comes from a third-party scanner, the page says so.

What you will not find here

No downloads, no working links to attacker servers, and no passwords or tokens. Hashes are included so researchers can look the files up.

Spotted a mistake?

Analysis can be wrong or go out of date, and scanner results change over time. Corrections are always welcome.