FlagThis - #reversinglabs

Check Point Research has revealed a significant malware campaign targeting Minecraft players. The campaign, active since March 2025, involves malicious modifications (mods) distributed through the Stargazers Ghost Network on GitHub. These fake mods, impersonating legitimate "Scripts & Macro" tools or cheats, are designed to surreptitiously steal gamers' sensitive data. The malware is written primarily in Java, a language often overlooked by security solutions, and contains Russian-language artifacts suggesting the involvement of a Russian-speaking threat actor. The popularity of Minecraft, with over 200 million monthly active players and over 300 million copies sold, makes it a prime target for such attacks.

The multi-stage infection chain begins when a user downloads and installs a malicious JAR file, disguised as a Minecraft mod, into the game's mods folder. This initial Java downloader employs anti-analysis techniques to evade detection by antivirus software. Once executed, it retrieves and loads a second-stage Java-based stealer into memory. This stealer then collects Minecraft tokens, account credentials from popular launchers like Feather and Lunar, Discord tokens, Telegram data, IP addresses, and player UUIDs. The stolen data is then exfiltrated to a Pastebin-hosted URL, paving the way for the final, most potent payload.

The final stage involves a .NET stealer with extensive capabilities, designed to steal a wide range of information. This includes browser data from Chrome, Edge, and Firefox, cryptocurrency wallet credentials, VPN credentials from NordVPN and ProtonVPN, and files from various directories such as Desktop and Documents. It can also capture screenshots and clipboard contents and harvest credentials from Steam, Discord, Telegram, and FileZilla. Over 1,500 Minecraft players have already been infected by these malicious mods distributed on GitHub. Researchers have flagged approximately 500 GitHub repositories used in the campaign.


References :

• blog.checkpoint.com: Minecraft Players Targeted in Sophisticated Malware Campaign
• Check Point Research: Fake Minecraft mods distributed by the Stargazers Ghost Network to steal gamers’ data
• securityaffairs.com: Malicious Minecraft mods distributed by the Stargazers DaaS target Minecraft gamers
• securityonline.info: Stargazers Ghost Network: Minecraft Mods Used to Distribute Multi-Stage Stealers via GitHub
• The Hacker News: 1,500+ Minecraft Players Infected by Java Malware Masquerading as Game Mods on GitHub
• Security Risk Advisors: 🚩 Stargazers Ghost Network Distributes Java Malware Through Fake Minecraft Mods Targeting Gaming Community
• Check Point Blog: Minecraft Players Targeted in Sophisticated Malware Campaign
• www.scworld.com: Counterfeit Minecraft mods deliver malware
• www.techradar.com: Minecraft players watch out - these fake mods are hiding password-stealing malware

Classification:

• HashTags: #Minecraft #Malware #GitHub
• Company: Check Point
• Target: Minecraft players
• Attacker: Stargazers Ghost Network
• Product: Minecraft
• Feature: data theft
• Malware: Java Stealer
• Type: Malware
• Severity: Medium

A malicious Python package named `solana-token` has been discovered on the Python Package Index (PyPI) targeting Solana developers. This rogue package, posing as a utility for the Solana blockchain, was designed to exfiltrate source code and developer secrets from compromised machines to a hard-coded IP address. The ReversingLabs research team uncovered this supply chain attack, highlighting the increasing trend of malicious actors targeting cryptocurrency projects. Before being taken down, the `solana-token` package was downloaded over 600 times, potentially distributed through developer-focused platforms.

The malicious package contained telltale signs of compromise, including hardcoded IP addresses, outbound communications to non-standard network ports, and code that reads local files, typical of information stealers. One insidious method employed by the package scanned the Python execution stack, copied, and exfiltrated source code contained in all the files in the execution chain to a remote server. The objective was to steal sensitive information such as developer secrets and hardcoded crypto credentials, which could grant attackers unauthorized access to cryptocurrency wallets and critical infrastructure.

This incident is not isolated, a previous package with the same name was published and removed in 2024, suggesting that the same malicious actors may be behind the new malicious version, said the report. Cybersecurity experts recommend that organizations respond to address the increasing number of supply chain threats targeting cryptocurrency projects by aggressively monitoring for suspicious activity and unexplained changes within open source and commercial, third-party software modules. By stopping malicious code before it is allowed to penetrate secure development environments, teams can prevent destructive supply chain attacks.


References :

• securityonline.info: PyPI Malware Alert: Malicious ‘solana-token’ Package Targets Solana Developers
• Blog (Main): Same name, different hack: PyPI package targets Solana developers
• securityonline.info: PyPI Malware Alert: Malicious ‘solana-token’ Package Targets Solana Developers
• The Hacker News: Malicious PyPI Package Posing as Solana Tool Stole Source Code

Classification:

• HashTags: #SupplyChainAttack #Cryptocurrency #Solana
• Company: ReversingLabs
• Target: Solana Developers
• Product: solana-token
• Feature: data exfiltration
• Malware: solana-token
• Type: Malware
• Severity: Medium