Links scam findings

HomeSamplesThe modpack with one extra file

The modpack with one extra file

In one sentenceA modpack that looks like a legitimate CurseForge pack contains one unlisted mod. That mod is a downloader: when the game starts, it fetches the real malware from a file-sharing link.

First seen
18 Oct 2026
How it arrived
Discord DM from a hacked account
What it steals
Not by itself; it installs a second program
Antivirus (first scan)
0 of 65 flagged it
Check on VirusTotal (opens in a new tab)

Opens the public scan page for the extra mod, the malicious file in this pack.

How it works, step by step

Swipe the diagram sideways to see all of it.

The animation plays by itself and loops. Pause it any time, or pick a step to jump to it (the left and right arrow keys work too). It is a diagram, not real malware.

Spot it, and what to do

How to spot it

  • The modpack's list names real mods, but there is one extra file in the mods folder that is not on the list.
  • The extra mod has a vague name and description, an official-sounding author ("Fabric Team"), and is only a few kilobytes. Real mods are usually megabytes.
  • It came from a chat message, not from the CurseForge or Modrinth page.
  • It arrived from a friend who "never sends files". Their account may be hacked.

If you already ran it

  • Look for a java folder inside %LOCALAPPDATA% containing services.jar. If it exists, treat the PC as infected.
  • Change passwords from a different, clean device. Email first, then Discord, Steam, Microsoft and your bank.
  • Sign out of all sessions, redo two-step login, and move any crypto to a new wallet.
  • Back up your files and reinstall Windows to be sure.

Technical details

For researchers: how it was analysed

The zip's manifest lists 19 genuine CurseForge projects. The extra file is overrides/mods/BetterSurvival.jar (6,337 bytes) with one class, com.example.mod.mc, in the default template package. It is obfuscated with ZKM (Zelix KlassMaster), which encrypts every string.

The strings were recovered statically by re-implementing the decryption routine from the class's bytecode, without executing the sample. The result is the chain in step 3 to 5: create %LOCALAPPDATA%\java, download java.zip from a file-sharing link, unpack and delete it, then run services.jar with the bundled javaw.exe. The download address is withheld here on purpose. The second-stage services.jar has not been analysed.

A third-party sandbox run of the jar executed it as a plain Java program, so the Fabric start-up code never triggered. That is why it showed no behaviour.

Update: contact with an account linked to this malware

In October 2026, an account believed to be connected to this sample's distribution was contacted directly. What follows is self-reported by that account, and some of it did not hold up.

  • The account first claimed to write the malware themselves in Java, using a custom obfuscator on top of a commercial one. Later information instead points to a premade builder sold for around $300 within a Turkish group, so this looks like bragging rather than fact. The obfuscation is likely a feature of that kit, not original work.
  • They claim to test each build against a public scanning service before distributing it, aiming for zero detections.
  • They said the download link in this sample gets suspended whenever someone reports it, forcing a rebuild with a new link each time. That confirms reporting these links works — it costs a rebuild and a redistribution cycle, not just one deleted file.

Nothing here was obtained by running the malware, and nothing was shared with the account to help it evade detection or reporting further.

File hashes (SHA-256)
FileHash
Modpack zip
6978177AE29F69BD938D68B9EFB84D76ACFAC031543EECD0841C40CC6A7241FAVirusTotal (opens in a new tab)
Extra mod (dropper)
DC8B4947BDCC79E93C7B952A9A921334CEB7F7E4AB03D26C06FB0CCF9C3A01E2VirusTotal (opens in a new tab)

Antivirus scores change as vendors update. At the first scan (18 Oct 2026) none of 65 engines flagged the jar. Look the hashes up on a scanning service for current results.

Why antivirus misses this: the file you receive is tiny and does nothing suspicious until the game loads it. The bad part is downloaded later.

Related samples