Malware in Minecraft mods, skins, and 'free' launchers
Unofficial mod sites and cracked launchers can bundle information-stealing malware aimed at young players, which then reaches the whole family computer.
- Most relevant to:
- Ages 9–12, 13–15, 16–17
- Commonly reported on:
- Minecraft
- Published:
- Last reviewed:
Start here: Install mods only from reputable sources you vet together (e.g., well-known mod repositories).
What is happening
- Unofficial sites offer mods, texture packs, or 'free'/cracked launchers that secretly bundle malware.
- Some campaigns have planted info-stealers in fake mod packs on code-sharing platforms, specifically targeting young players.
- Once installed, the malware can steal passwords and session tokens from the whole family computer.
Why it matters
Potential impact: An information-stealer harvesting saved passwords and session tokens for every account on the household computer, including a parent's email and banking.
Recommended next step: Review soon. Worth reviewing or discussing this week.
What to watch for
- Downloads from unofficial 'free Minecraft' sites.
- New programs or browser extensions you didn't approve.
- Antivirus alerts, or family accounts being accessed from new devices.
What parents can do
- Install mods only from reputable sources you vet together (e.g., well-known mod repositories).
- Keep antivirus enabled and the OS updated.
- Have the child use a standard (non-administrator) account, and prefer the official launcher.
Start the conversation
“Let's install mods together. Not because I don't trust you — because the fake ones are built to look exactly like the real ones, and they go after my accounts as well as yours.”
Say it in your own words, before anything has gone wrong. A child who has heard this once already knows where to go the day it matters.
Sources and evidence
Evidence: Confirmed. Corroborated by two or more independent organizations — safety bodies, regulators, researchers, or established newsrooms. Last reviewed
If this is happening now
- Disconnect the device from the network and run a full scan with reputable antivirus software.
- From a different, clean device, change the passwords for email, banking, and any account used on that machine, and sign out of all sessions.
- Turn on two-factor authentication on the accounts that matter most, and check for logins from unfamiliar devices.
If a child is in immediate danger, contact local emergency services. To report online exploitation, use the NCMEC CyberTipline, or Take It Down to get an image removed.
Get the signal without the noise
One concise briefing when something meaningfully changes — what happened, who it may affect, and one practical next step. See a sample issue.