Hundreds of Minecraft mods on GitHub are infested with hard-to-spot spyware

Let’s say, as a thought experiment, that you’re a malware developer. You can choose to target specific groups of people to distribute your nefarious payloads. You might just go for a scattershot approach, but that’s less effective. You might aim for the technologically unsophisticated, or older people who aren’t as engaged. Or you can go for the lowest-hanging fruit: kids playing video games.

That seems to be the choice for the latest batch of spyware, which is hiding in mods for the indefatigable Minecraft, now getting a predictable boost from a smash-hit kid’s movie. According to Check Point Research (via Bleeping Computer), a “multistage campaign” is going after Minecraft players looking for game mods on GitHub.

The “Stargazers Ghost” network, allegedly a for-hire operation based in a Russian-speaking country, targets login information for the Minecraft game account, other third-party launchers, social media, and text app info. A second-stage program will try to steal more personal info in browser caches and other apps, with an emphasis on logins, passwords, and of course, cryptocurrency.

The malware campaign has been spread across more than 500 GitHub repositories according to the report, and it’s a sneaky one, hiding in Minecraft Java installers to bypass many antivirus scans. Hiding this stuff on GitHub (which, like Minecraft itself, is owned by Microsoft) is particularly nefarious. While it’s mostly used for collaborative software development, downloads for software meant for end-users is now frequently hosted on GitHub itself. The technical interface and jargon might make it seem a little more trustworthy than a sketchy download site to an uncritical eye, or indeed, a child.

GitHub does police its repositories for malware and other threats. But a centralized, company-based security team can often be overwhelmed by attackers based on numbers alone, to say nothing of a sophisticated campaign from a team of dedicated developers.

To protect yourself or your kids when looking for Minecraft mods, Bleeping Computer recommends checking out GitHub page thoroughly, and testing mods on a “burner” account. Alternatively, I might suggest locking down a kid’s computer and telling them they have to stick to the official mods available in the “Bedrock Edition” of the game.