Scammers pose as video collaborators needing help then push rigged modpacks through CurseForge. One launch and your accounts are compromised. Multiple creators issued warnings after it nearly hit them highlighting how fast this is spreading in the modded SMP scene.
The Minecraft multiplayer and modding community runs on trust. People share modpacks for SMPs collabs and testing all the time. Scammers just turned that into a weapon.
How This Attack Works
According to creator Shirybun the process starts with a message offering or requesting help on a Minecraft video. The target is then told to install a particular modpack via CurseForge. Once the pack launches the malware triggers and accounts get hijacked. It is hitting enough people that PSAs are now going viral.
The warning gained quick traction because the modded scene is huge. CurseForge is the default launcher for millions. Turning it into an attack vector is smart predatory and unfortunately effective.
Im not normally the type of person to do PSA stuff but be careful with the new scam its getting a lot of people and almost got me too
- Only download modpacks from verified sources or creators you actually know
- Treat unsolicited collab requests asking for specific installs as red flags
- Enable 2FA everywhere and monitor linked Microsoft accounts closely
- Report suspicious messages instead of engaging
Bigger Picture
This comes after previous waves of account takeovers that already have the community on edge. The overlap with content creators and SMP regulars makes it especially damaging. One wrong click during what feels like a normal interaction and your skin your worlds your purchases are all at risk.
The real fix is skepticism. Minecrafts online scene rewards openness but that openness is now a liability when scammers study how creators actually work and replicate it.
Other
