FlagThis - #reversinglabs

Check Point Research has revealed a significant malware campaign targeting Minecraft players. The campaign, active since March 2025, involves malicious modifications (mods) distributed through the Stargazers Ghost Network on GitHub. These fake mods, impersonating legitimate "Scripts & Macro" tools or cheats, are designed to surreptitiously steal gamers' sensitive data. The malware is written primarily in Java, a language often overlooked by security solutions, and contains Russian-language artifacts suggesting the involvement of a Russian-speaking threat actor. The popularity of Minecraft, with over 200 million monthly active players and over 300 million copies sold, makes it a prime target for such attacks.

The multi-stage infection chain begins when a user downloads and installs a malicious JAR file, disguised as a Minecraft mod, into the game's mods folder. This initial Java downloader employs anti-analysis techniques to evade detection by antivirus software. Once executed, it retrieves and loads a second-stage Java-based stealer into memory. This stealer then collects Minecraft tokens, account credentials from popular launchers like Feather and Lunar, Discord tokens, Telegram data, IP addresses, and player UUIDs. The stolen data is then exfiltrated to a Pastebin-hosted URL, paving the way for the final, most potent payload.

The final stage involves a .NET stealer with extensive capabilities, designed to steal a wide range of information. This includes browser data from Chrome, Edge, and Firefox, cryptocurrency wallet credentials, VPN credentials from NordVPN and ProtonVPN, and files from various directories such as Desktop and Documents. It can also capture screenshots and clipboard contents and harvest credentials from Steam, Discord, Telegram, and FileZilla. Over 1,500 Minecraft players have already been infected by these malicious mods distributed on GitHub. Researchers have flagged approximately 500 GitHub repositories used in the campaign.


References :

• blog.checkpoint.com: Minecraft Players Targeted in Sophisticated Malware Campaign
• Check Point Research: Fake Minecraft mods distributed by the Stargazers Ghost Network to steal gamers’ data
• securityaffairs.com: Malicious Minecraft mods distributed by the Stargazers DaaS target Minecraft gamers
• securityonline.info: Stargazers Ghost Network: Minecraft Mods Used to Distribute Multi-Stage Stealers via GitHub
• The Hacker News: 1,500+ Minecraft Players Infected by Java Malware Masquerading as Game Mods on GitHub
• Security Risk Advisors: 🚩 Stargazers Ghost Network Distributes Java Malware Through Fake Minecraft Mods Targeting Gaming Community
• Check Point Blog: Minecraft Players Targeted in Sophisticated Malware Campaign
• www.scworld.com: Counterfeit Minecraft mods deliver malware
• www.techradar.com: Minecraft players watch out - these fake mods are hiding password-stealing malware

Classification:

• HashTags: #Minecraft #Malware #GitHub
• Company: Check Point
• Target: Minecraft players
• Attacker: Stargazers Ghost Network
• Product: Minecraft
• Feature: data theft
• Malware: Java Stealer
• Type: Malware
• Severity: Medium

A malicious Python package named `solana-token` has been discovered on the Python Package Index (PyPI) targeting Solana developers. This rogue package, posing as a utility for the Solana blockchain, was designed to exfiltrate source code and developer secrets from compromised machines to a hard-coded IP address. The ReversingLabs research team uncovered this supply chain attack, highlighting the increasing trend of malicious actors targeting cryptocurrency projects. Before being taken down, the `solana-token` package was downloaded over 600 times, potentially distributed through developer-focused platforms.

The malicious package contained telltale signs of compromise, including hardcoded IP addresses, outbound communications to non-standard network ports, and code that reads local files, typical of information stealers. One insidious method employed by the package scanned the Python execution stack, copied, and exfiltrated source code contained in all the files in the execution chain to a remote server. The objective was to steal sensitive information such as developer secrets and hardcoded crypto credentials, which could grant attackers unauthorized access to cryptocurrency wallets and critical infrastructure.

This incident is not isolated, a previous package with the same name was published and removed in 2024, suggesting that the same malicious actors may be behind the new malicious version, said the report. Cybersecurity experts recommend that organizations respond to address the increasing number of supply chain threats targeting cryptocurrency projects by aggressively monitoring for suspicious activity and unexplained changes within open source and commercial, third-party software modules. By stopping malicious code before it is allowed to penetrate secure development environments, teams can prevent destructive supply chain attacks.


References :

• securityonline.info: PyPI Malware Alert: Malicious ‘solana-token’ Package Targets Solana Developers
• Blog (Main): Same name, different hack: PyPI package targets Solana developers
• securityonline.info: PyPI Malware Alert: Malicious ‘solana-token’ Package Targets Solana Developers
• The Hacker News: Malicious PyPI Package Posing as Solana Tool Stole Source Code

Classification:

• HashTags: #SupplyChainAttack #Cryptocurrency #Solana
• Company: ReversingLabs
• Target: Solana Developers
• Product: solana-token
• Feature: data exfiltration
• Malware: solana-token
• Type: Malware
• Severity: Medium

ReversingLabs has identified a malicious npm package named "pdf-to-office" that targeted cryptocurrency users by injecting malicious code into locally installed Atomic Wallet and Exodus software. The package, posing as a utility for converting PDF files to Microsoft Office documents, actually overwrites existing, legitimate files within the crypto wallet installations. This allowed attackers to silently hijack crypto transfers by swapping out the intended destination address with one belonging to the malicious actor. The ReversingLabs team continues to track threat actors using a variety of techniques to hijack popular crypto packages.

This attack vector involved the malicious patching of local software, a technique that allows attackers to intercept cryptocurrency transfers without raising immediate suspicion. The "pdf-to-office" package targeted specific versions of both Atomic Wallet (2.91.5 and 2.90.6) and Exodus (25.13.3 and 25.9.2), ensuring that the correct Javascript files were overwritten. Once executed, the malicious code would check for the presence of the "atomic/resources/app.asar" archive for Atomic Wallet and "src/app/ui/index.js" for Exodus.

The compromised wallets would then channel crypto funds to the attacker's address, even if the "pdf-to-office" package was subsequently removed from the system. ReversingLabs' Spectra Assure platform flagged the package as suspicious due to its behaviors mirroring previous npm-based malware campaigns. The initial release was on March 24, 2025, before being removed. The latest version, 1.1.2, was uploaded on April 8 and remains available for download.


References :

• hackread.com: ReversingLabs reveals a malicious npm package targeting Atomic and Exodus wallets, silently hijacking crypto transfers via software patching.
• Blog (Main): Threat actors have been targeting the cryptocurrency community hard lately.
• secure.software: Atomic and Exodus crypto wallets targeted in malicious npm campaign
• The Hacker News: Threat actors are continuing to upload malicious packages to the npm registry so as to tamper with already-installed local versions of legitimate libraries and execute malicious code in what's seen as a sneakier attempt to stage a software supply chain attack.
• www.scworld.com: Atomic, Exodus wallets subjected to malicious npm package attack Attackers have been looking to compromise users of the Atomic and Exodus cryptocurrency wallets through the new pdf-to-office npm package spoofing a PDF to Microsoft Word document converter, The Hacker News reports.
• gbhackers.com: Threat Actors Exploit Legitimate Crypto Packages to Deliver Malicious Code
• gbhackers.com: Threat actors exploit legitimate crypto packages to deliver malicious code
• hackread.com: npm Malware Targets Atomic and Exodus Wallets to Hijack Crypto Transfers

Classification:

• HashTags: #CryptoScam #SupplyChainAttack #Web3
• Company: ReversingLabs
• Target: Crypto Wallets
• Product: npm
• Feature: Malicious Package Injection
• Malware: pdf-to-office
• Type: Malware
• Severity: Major