Minecraft Discord Scams in 2026: How Fake Verification Links and Modpacks Steal Accounts

It started like any other Discord message. In early April 2026, a Minecraft player was invited to “verify” their account for a server tournament. The page looked exactly like a Microsoft sign-in. They entered a code, and within minutes their recovery email had been changed. Their Minecraft profile, Realms and purchases were gone. On April 7 they posted a desperate plea on Microsoft’s own support forum: they couldn’t get back into their own account.

They were far from alone. Through 2026, Minecraft players reported the same handful of tricks again and again, each built to exploit one thing: trust.

The fake verification link

The April attack didn’t steal a password at all. Victims are sent to a real-looking Microsoft page and asked to approve a sign-in or enter a code. What they’re actually doing is granting an attacker’s app access to their Microsoft account. With that access, the scammer adds their own recovery details and locks the owner out of Minecraft, Realms, Marketplace items and Xbox services. Because the victim technically approved it, many security warnings never fire.

The bait is usually a server event, a tournament sign-up, a “verification bot” in a public Discord, or a direct message from someone who seems helpful.

The nostalgia invite

In May, players started getting emails inviting them to a “Minecon Alumni 2026” reunion, which claimed 9,000 people had already signed up. It was a phishing campaign. The link asked people to connect their Microsoft account. Readers on r/Minecraft spotted the giveaway immediately: the email came from a lookalike domain, not from Mojang or Minecraft.net. Mojang does not run Minecon alumni events.

The friend who needs you to test a modpack

The most damaging version arrived in late May and grew through June. A Discord friend you haven’t spoken to in a while sends a message. They’re building a private server, or a buddy needs playtesters, and you just have to install this one modpack or custom launcher. The link looks like CurseForge or a normal download page.

The file is malware. Reports on r/Scams and from GamingHQ described infostealers and remote access trojans (RATs). They empty saved browser passwords, steal Discord tokens and Minecraft session data, grab crypto wallets and take screenshots. Then they use your Discord account to message everyone you know. The “friend” who messaged you was a victim first.

Some smaller servers have faced similar accusations of hiding malware in “required” client files. The rule is the same either way: a server never needs you to run an unknown program.

The copycat server

Some scams start inside Minecraft itself. Investigator TheMisterEpic documented scammers posting harmless-looking event ads in the chat of big legitimate servers, with server addresses for copycats that use familiar-sounding names. The fake server then pushes players into a Discord where the account theft happens, often with a “verification” step or a custom launcher. In one April case shared on Reddit, a friend’s DM about joining a “Hello Kitty SMP” ended with a launcher download that installed a spying trojan.

The fake client

A third trap targets players looking for an edge. Security firm Netskope documented a Python remote access trojan disguised as Nursultan Client, a real unofficial client popular in Eastern European communities. The fake arrives as a 68.5 MB Windows program. It hides its console window and shows a convincing installation progress bar while it sets itself up to run at every startup.

From then on it takes orders from a Telegram bot. The attacker can take screenshots, switch on the webcam, open web pages and search files for Discord tokens and saved logins. The same pattern keeps returning under new client names, because it targets a habit many players share: downloading unofficial clients and “cracked” launchers from Discord links.

How to protect your account

1. Never enter a code or approve a sign-in you didn’t start. Microsoft will never ask you to verify through a Discord bot.
2. Only download mods and clients from official sources: Modrinth or CurseForge, opened by typing the address yourself, not from a link in a DM. Be wary of a modpack that arrives as an .exe or .jar file, or as a “launcher”.
3. Check a friend’s odd request somewhere else, by text or call, before clicking anything.
4. Review app permissions on your Microsoft account. At account.live.com/consent/Manage, remove anything you don’t recognise.
5. Turn on two-step verification or a passkey and keep your recovery email and phone up to date.
6. Don’t save passwords in your browser if you install mods often. Use a password manager instead.

If it already happened

1. From a clean device, sign out of all sessions and change your Microsoft password at account.microsoft.com/security.
2. If you’re locked out, use Microsoft’s account recovery form. Give as many old passwords and purchase details as you can.
3. Reset your Discord password, which invalidates stolen tokens, and warn your friends.
4. If you ran a downloaded file, assume the PC is compromised. Scan it, or better, reinstall Windows before logging into anything important again.

The players who lost accounts this year weren’t careless. They trusted a familiar name or an official-looking page. A ten-second check before clicking is now part of playing Minecraft online. For the malware side (fake mods and cheat clients like WeedHack), see our mod malware guide. For a related case of a server allegedly abusing client-side mods, see our DonutSMP investigation.