Is fractureiser still a risk to Minecraft mod players

Fractureiser was malware found in June 2023 inside mods and plugins uploaded to CurseForge and BukkitDev. It targeted Windows and Linux only, and the people who investigated it say it spread through the mod files themselves. The investigators' repository states the event has ended: no follow-up first-stage files were found and no further activity appeared in the three months before they wrote that, as read on 10 October 2026. The same repository calls a copycat likely and inevitable, and no platform can promise that every file is clean.

We did not scan or test any file. This page reports what the platforms and investigators publish about the incident and what has gone wrong in public.

What the platforms and investigators said

The sources read describe no review process for either platform, so there is no statement of routine checks to report. They do record what was said during the incident. The Prism Launcher news post says both Modrinth and CurseForge stated that all infected files had been removed or that they were unaffected, and it separately lists Modrinth among platforms known to be unaffected. The same post says Windows Defender began detecting some infected files on 8 June 2023 UTC, and calls that detection of the first-stage files inconsistent.

The response itself came from volunteers. The investigators' repository describes a fractureiser Mitigation Team that coordinated on one public channel, #cfmalware on EsperNet, and held a follow-up meeting with community members on 2023-06-08 about preventing a repeat. For how the two platforms handle uploads today, read Is CurseForge Safe to Download Minecraft Mods From and Is Modrinth Safe to Download Mods From.

What has gone wrong

BleepingComputer (7 June 2023) and the investigators describe four stages. Stage 0 was a malicious function added to the end of a mod's main class. It fetched a file from a remote address, which retrieved the address of a control host and then stored a loader in a folder named Microsoft Edge (Windows) or a hidden data folder under the user's config directory (Linux). The final stage, per BleepingComputer, could infect other Java files on the machine, steal browser cookies and saved credentials, swap cryptocurrency wallet addresses on the clipboard, and take Microsoft, Discord and Minecraft launcher credentials.

Affected projects named by Prism and BleepingComputer include Dungeons Arise, Sky Villages, the Better MC modpack series and, on Bukkit, plugins such as Simple Harvesting and MCBounties. Fabulously Optimized was listed as found not to be compromised. Prism says the affected profiles had two-factor login enabled and that the cause was not established. Its theories were a stolen login token or a wider fault on the CurseForge side, and Kaspersky adds that Prism's developers suspected a flaw in the Overwolf platform.

What the checks do not cover

Prism reports that some modpack updates were published without the authors' knowledge and archived at once, so they were hidden in the web interface and reachable only through the API. Prism also says any launcher that uses the CurseForge API was exposed, though nothing updates itself unless a player set it to. It raises the possibility that downloads were poisoned because of CurseForge's use of MD5 to verify files, and says it could not tell whether the malicious mods were always malicious or edited later.

Prism's post advises extra caution with less trustworthy services even after the cleanup. Kaspersky notes that mods are written by enthusiasts and hosted independently, so Mojang is not responsible for their security and does not guarantee it. A file that looks harmless on a listing page therefore tells you little about what a later update contains. What a Minecraft Mod Is and What It Needs explains why a mod runs with the same access as the game.

What you can do

• If you have never used Minecraft mods, the investigators say you are not infected.
• Keep Windows security updates current. Prism says Defender added detections on 8 June 2023 UTC, and BleepingComputer says more antivirus engines add detections as time passes, so a later rescan can find what an early one missed.
• Look for the signs the sources name. On Windows these are a file called libWebGL64 in the Microsoft Edge folder under local app data, an unusual Run registry entry, a startup shortcut, or a file named installer in the temp folder. On Linux they are lib.jar in the hidden .data folder under ~/.config and a systemd-utility.service entry.
• Scan with antimalware software. Kaspersky advises this for anyone who used third-party mods, and Prism points to a community web scanner for files you doubt.
• Treat a hit seriously. Prism says to change all passwords, because saved browser passwords were likely taken. BleepingComputer adds that the machine should be cleaned, ideally by reinstalling the operating system, then unique passwords set, starting with email, banking and crypto.

For where mods are fetched and what gets checked, see Where to Download Minecraft Mods and What Gets Checked. Installation steps are in How to Install Minecraft Mods on Java Edition.

Fractureiser, a followup at 3am

Watch on YouTube