MALICIOUS (1) campaign cataloged at 2026-10-12(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-10-minecraftaccfinder¶
During import, the code installs a persistent inforstealer / RAT. The code first exfiltrates multiple credentials (targeting especially Gmail, Roblox, Discord, and Minecraft) and then opens a port and listens for further C2 commands. It also includes a keylogger, periodic screenshot sending, advanced extracting credentials from browsers, and some detection evasion techniques. In multiple versions the code seems not to be fully functional
Abuse categories¶
RAT
Malicious activity is typical for Remote Access Trojans (RATs).
exfiltration_browser_data
Campaign uses exfiltration_browser_data.
infostealer
Activity is typical for information stealers, i.e. by exfiltrate various sensitive data from the victim's environment.
keylogger
Campaign uses keylogger.
persistence
Campaign uses persistence.
remote_commands
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
spyware-like
Campaign uses spyware-like.