Links scam findings

HomeSamplesThe fake Fabric API

The fake Fabric API

In one sentenceA file posing as Fabric API, one of the most common Minecraft mods, contains a hidden, obfuscated program. Decoded at runtime, it steals credentials and Discord accounts and can be controlled remotely.

First seen
1 Oct 2026
How it arrived
Inside a modpack sent to a friend, who was infected
What it steals
Passwords, cookies, Discord accounts, payment details
Extra powers
Screenshots, webcam, remote control
Check on VirusTotal (opens in a new tab)

Opens the public scan page for the decoded payload. It may say "not found" if nobody has submitted it yet.

How it works, step by step

Swipe the diagram sideways to see all of it.

The animation plays by itself and loops. Pause it any time, or pick a step to jump to it (the left and right arrow keys work too). It is a diagram, not real malware.

Spot it, and what to do

How to spot it

  • The version number doesn't exist. This claimed to be Fabric API 0.118.7 for Minecraft 1.21.1, but that version was never released.
  • The real jar is a few megabytes with a folder of neatly named parts inside. The fake one is nearly empty but has one huge file with no file type.
  • The real jar's files all share one fixed date from 1980. The fake one has real, recent dates.
  • The license file has the name of a different project.

If you already ran it

  • Open Task Scheduler and look for a task called JavaUpdateSched. Check the Windows startup entries for JavaUpdater_2418.
  • Change every password from a clean device, starting with email. Sign out of all Discord sessions.
  • Reinstall Discord completely, because this program changes its files. Make new backup codes.
  • Reinstall Windows, then watch your bank and card activity.

Technical details

For researchers: how it was analysed

The fake jar had a roughly 1 KB fabric.mod.json, a small loader, and a 20 MB extensionless resource named amcik. Its bytes were a ZIP file XOR-encoded with the single byte 0x06 (header 56 4D 05 02 decodes to 50 4B 03 04). The decoded archive is a Java program with main class me.akita.Entrypoint and roughly 1,800 library files (a Discord bot library, an HTTP client, SQLite, JNA, a webcam library).

It uses a mutex (Global\SparkBotMtx_7f3a), a scheduled task (JavaUpdateSched) and a registry Run value (JavaUpdater_2418), both launching javaw.exe -jar. Browser theft includes a public bypass of Chrome's app-bound encryption. It also injects JavaScript into the Discord desktop client to capture logins, two-step codes and payment forms.

Command and control runs through a Discord bot that opens a channel per victim, plus webhooks. The identifiers of that infrastructure are withheld here on purpose and were not tested.

It shares a set of custom Discord badge images with "The pack with no mods", so the two may come from the same builder or kit. That is a lead, not proof of a single author.

Why it bothers reading badges at all: an account's visible badges (Early Supporter, HypeSquad, boost level, rare or animated badges) are what a stolen-account reseller uses to price it. The badge-reading code here is account triage, not a cosmetic feature.

Update: contact with an account linked to this malware

In October 2026, an account believed to be connected to a related sample (see "The modpack with one extra file") was contacted directly. What follows is self-reported, and some of it did not hold up.

  • The account first claimed to write the malware themselves, plus a separate native executable variant. Later information instead points to a premade kit sold within a Turkish group, so this looks like bragging rather than fact. That fits this sample too: it shares a set of custom badge images with the other sample above, which is easier to explain as two buyers of the same kit than as one person's original code.
  • They claim to test each build against a public scanning service before distributing it, aiming for zero detections.
  • They described stealing high-value Discord accounts specifically to resell them, citing badges like Early Supporter or a long boost history as what sets the price.

Nothing here was obtained by running the malware, and nothing was shared with the account to help it evade detection further.

File hashes (SHA-256)
FileHash
Decoded payload (zip)
71DB3A7BEC4AF717297BCCBD29594A0D5C34C35FE42429D77F9C05C173CA2A12VirusTotal (opens in a new tab)

At last check (9 Oct 2026) this hash was not known to VirusTotal. Results change over time.

Related samples