Minecraft players are once again the target of malware operators. According to a report published yesterday, a Python-based remote access trojan is being distributed under the name Nursultan Client, a fake modified Minecraft build aimed at specific gaming communities.
The attack chain relies on social engineering. Users looking for cheats, mods, or cracked versions download the tainted client. After installation the malware establishes persistence and phones home to a Telegram bot controlled by the attackers.
Capabilities include taking screenshots, activating the webcam, opening arbitrary web pages or images, and specifically hunting for Discord token and login data stored on the machine. The operators appear to be using a malware-as-a-service style setup with Telegram as the command channel.
What the malware actually does
- Exfiltrates Discord login keys and session data
- Captures screenshots and webcam footage on command
- Runs arbitrary commands via Telegram bot
- Targets files associated with popular browsers and apps
This is not the first time Minecraft has been used as bait for infostealers and RATs. Previous campaigns like WeedHack showed how effective the lure is, especially among younger players hunting for free mods or hacked clients. The new variant demonstrates the infrastructure takedowns do not end the threat; actors simply pivot to new delivery methods including Discord links and fake reseller sites.
Official Minecraft launcher and Marketplace content remain the only safe routes. Anything hosted on random MediaFire links, shady GitHub forks, or “client” download pages should be treated as hostile until proven otherwise. If you have downloaded something suspicious, change passwords, enable 2FA everywhere, and scan the machine.
