You can check if you're infected by using the detector tools released by CurseForge here. Due to the fact that it can replicate itself into mods, it's highly likely that anyone who has been infected with the malware now has it injected into the mods on their system. It self replicates itself, injecting a payload into any Minecraft mods in your system so that it can spread, and that's believed to be how it got onto CurseForge, unknowingly uploaded after the devs machines were infected. There are some smart people going through and finding out what the malware does, but at a high level it looks like it steals authentication credentials for Minecraft/Microsoft accounts that are logged into various launchers (not including ATLauncher), as well as stealing browser cookies and discord tokens as well as other things. This included being included in some modpacks.

There is currently an ongoing incident within the Minecraft modding community where malware has been found to be included in some Minecraft mods (and bukkit plugins) on CurseForge.

As always, if you have any concerns or questions, please reach out in #malware-incident channel in our Discord. Keep an eye out for more updates on that in the coming week or two. ATLauncher will be investigating how we can detect for and warn against this type of attack going forward, including checking not only for this specific type of malware, but also checking for changes to your mods since downloading. Make sure that you have scanned your system using the tools mentioned above before installing or playing Minecraft. Non official modpacks were not verified as they use external download sources, so if you plan on installing a third party pack from Technic, you should be cautious and scan after downloading. Several platforms have come out and confirmed that they've scanned and removed all traces (if there were any) of the malware from their sites: - ATLauncher: All clear to install and use ATLauncher modpacks - CurseForge: All clear to install and use CurseForge modpacks and install and use CurseForge mods - Modrinth: All clear to install and use Modrinth modpacks and install and use Modrinth mods - Technic: All clear to install and use Technic official modpacks. The situation seems to have relaxed a bit, the details on the malware and what it does is known (again if you're interested take a look at this GitHub repo) and we have tools available to detect if you're infected: - CurseForge Infected mods detection tool - NekoDetector Both these tools will detect for any traces of the malware on your PC or within your modded Minecraft installations (be sure to scan your entire drives, or at least your user folder and any folders where you run Minecraft from).

Most popular modded minecraft server