Open Source 2023-06-01 · 7 days ·Data Exfiltration

Better MC modpacks shipped Fracturiser malware

Part of the Fracturiser mod campaign stole player credentials campaign

The CurseForge account for 'Luna Pixel Studios', creators of the very popular 'Better MC' modpack series, was compromised. Attackers uploaded malicious versions of the modpacks (e.g., BMC3 for Forge 1.19.2).

Story

Better MC mattered because it was a modpack, not a single small mod. A compromised Luna Pixel Studios publishing account let attackers place Fracturiser into releases that players installed as trusted bundles.

The named affected scope included Better MC Forge BMC3, Better MC Forge BMC2, and Better MC Fabric. Those packages pulled together many mods under a familiar project name, so the malicious upload inherited trust from both the modpack brand and its dependency graph.

Fracturiser used the Minecraft loader path as execution. Once a poisoned JAR was loaded, the staged malware reached beyond the game and targeted host data on Windows and Linux, including secrets useful for accounts and further spread.

The cleanup problem was therefore not just "remove one mod." Players had to treat the whole affected modpack install as suspect, then scan for active infection and for dormant JARs that could restart the chain later.

This record stays separate from the campaign because Better MC was one of the high-signal package scopes. The campaign explains the shared malware; this record preserves the concrete releases players were told to remove and scan around.

Affected Artifacts

Incident Context

Motive
Credential Theft
Attribution
Group
Cause
Compromised Account Credentials
Transitive
No
Actor
Cybercriminal Gang

Indicators

External References

Source record: oss/attacks/better-mc/meta.yaml