If you ever install a random Minecraft client because a Discord server promised better performance or exclusive mods, this is exactly why you should not. Security researchers at Netskope just dropped a report on a new Python RAT that uses the name “Nursultan Client” to look legit. That name belongs to an actual community client popular in Russian and Eastern European circles, which makes the social engineering land perfectly.
The malware does not just steal one thing and vanish. It registers itself under the same name in the Windows registry for persistence, then waits for commands from a Telegram bot. Operators can force it to take screenshots, open the webcam, launch arbitrary web pages, or pull Discord tokens straight out of the local storage. All of it happens silently while you are busy building or PvPing.
The fake installer even shows on-screen messages pretending to be a normal Minecraft launcher. That is the level of effort that separates drive-by junk from something that actually works on people who know better but still click the link at 2 a.m.
- Uses the real Nursultan Client name in registry keys and fake setup text
- Telegram Bot API for command-and-control, no custom server needed
- Steals Discord tokens, screenshots, webcam images, and can open attacker-chosen URLs
- Persistence survives reboots
- Appears built for resale as MaaS
Java Edition players who stick to official launchers and Modrinth or CurseForge are mostly safe. The danger spikes the moment you chase performance mods, hacked clients, or “free cape” downloads from random sources. The same pattern that powered earlier 2026 token-stealing waves, just with a fresh coat of Telegram paint.
Using the name of a known Minecraft client is a clear social-engineering tactic to fool victims, especially gamers.
Nikhil Hegde, senior security researcher at Netskope, in the official analysis. The report includes indicators of compromise and detection guidance for anyone running endpoint protection. Bottom line: delete anything that calls itself Nursultan Client unless you compiled it yourself, and stop handing random executables your Discord session.
