Trojanized Minecraft Mod Distributes Myth Stealer RAT, Targeting Gamers’ PCs

A counterfeit version of a popular Minecraft performance‑enhancement mod has been identified as a delivery vector for Myth Stealer 3.2‑FIX, a sophisticated password‑stealing trojan with remote‑access and surveillance capabilities.

The rogue mod masquerades as an add‑on to the legitimate Lithium project, a widely used optimizer that reduces lag and improves frame rates for Minecraft players. Security researchers discovered that the fake package contains a hidden payload that installs the Myth Stealer RAT, which can capture login credentials, log keystrokes, take screenshots, and maintain persistence on infected machines.

Myth Stealer 3.2‑FIX is part of a broader family of information‑stealing malware that has been active since at least 2022. Its latest iteration adds features for victim harassment, such as the ability to display intrusive messages or trigger system reboots, making it attractive to cybercriminals seeking both financial gain and disruptive impact.

GBHackers first reported the campaign, noting that the malicious mod is distributed through unofficial Minecraft community forums and file‑sharing sites. Because the counterfeit mod is presented as a legitimate performance tweak, users often download it without verifying its source, inadvertently granting the malware administrative privileges required for deep system access.

Cybersecurity experts advise players to obtain mods exclusively from trusted repositories, such as the official CurseForge or the developers’ own websites, and to verify digital signatures when available. Running the game with elevated privileges should be avoided, and users are encouraged to keep their operating systems and security software up to date to detect and block the RAT’s behavior.

Authorities have not yet linked the distribution network to a specific threat actor, but the use of a popular gaming platform suggests a strategic shift toward targeting a broader, less‑technical audience. As the Minecraft community continues to grow, security professionals warn that similar trojanized tools could emerge, underscoring the need for heightened awareness and proactive defensive measures.