Links scam findings

HomeSamplesThe pack with no mods

The pack with no mods

In one sentenceA modpack with an empty mod list ships a single 19 MB jar named "Performance Helper". The jar is an infostealer that targets browser logins, Discord sessions and crypto wallets.

First seen
8 Oct 2026
How it arrived
A zip file posing as a modpack
What it steals
Browser logins, Discord, crypto wallets
Antivirus (9 Oct 2026)
3 of 61 flagged it after a re-scan
Check on VirusTotal (opens in a new tab)

Opens the public scan page for swap.jar, the malicious file in this pack.

How it works, step by step

Swipe the diagram sideways to see all of it.

The animation plays by itself and loops. Pause it any time, or pick a step to jump to it (the left and right arrow keys work too). It is a diagram, not real malware.

Spot it, and what to do

How to spot it

  • The modpack's mod list is empty, yet the zip has a mods folder with a file in it.
  • The author is "Mojang". Mojang doesn't publish mods like this, and neither does a "performance" mod from a stranger.
  • The mod is about 19 MB and contains Windows login-theft code, far too heavy for a tweak.
  • The first antivirus scan said "clean". A fresh scan a day later flagged it. Always re-check.

If you already ran it

  • Check your Windows Startup folder and Task Scheduler for entries you don't recognise.
  • Look in your hosts file for Discord addresses you didn't add.
  • Change passwords from a clean device, sign out of all sessions, and reset two-step login.
  • Move crypto to a new wallet, then back up your files and reinstall Windows.

Technical details

For researchers: how it was analysed

The zip's manifest has an empty files list. overrides/mods/swap.jar declares itself as Fabric mod id perfhelper and as Main-Class, Premain-Class and Agent-Class Main, so it can run as a program, as a Java agent, or as a mod through SwapFabricMod or SwapForgeMod.

About 2,900 of its 2,966 entries are bundled libraries. The attacker code is a set of root-level classes that read Chromium and Firefox data (including Chrome's app-bound encryption keys), Discord tokens and wallet extensions. It has an embedded HTTP server with a command interface, edits the hosts file to block Discord QR login, installs a startup shortcut and scheduled task, and impersonates Winlogon to get a SYSTEM token. Some strings are in Turkish.

It shares a set of custom Discord badge images with "The fake Fabric API", which suggests a common builder or kit. That is a lead, not proof of a single author. The two use different code, so this is not a repackaged copy.

File hashes (SHA-256)
FileHash
Modpack zip
518A61154AF449A15D209C36A55DDC77B78DE0000E8754555281AC443B9F095DVirusTotal (opens in a new tab)
swap.jar
E6973B438F46808321F3B3E7D69CDF41ABB7D65B85D92DA7364722E02032EE0CVirusTotal (opens in a new tab)

A re-scan on 9 Oct 2026 showed 3 of 61 engines flagging the jar as a password-stealing Java trojan; the first scan a day earlier showed none. Look the hashes up for current results.

Related samples