Minecraft: Dark Tale of Scams, Malware & Extortion
Essential information
- Published
- 18/03/2026 10:42
- Modified
- 18/03/2026 11:22
- Tags
- 2026-03-18 data theft discord malware minecraft mod packs scam social engineering spark stealer stealer sugarsmp
- Related entities
- 51 observables, 11 techniques (mitre), 1 malware, 51 others
Description
The article exposes a sophisticated scam targeting Minecraft players through fake 'grief-free' server communities. The SugarSMP website, promising a safe gaming experience, was found to distribute malware-infected mod packs. The malware, named Spark stealer, steals sensitive data including Discord tokens, browser credentials, and crypto wallet information. The threat actors employ social engineering tactics to maintain their fake community's reputation and remove warnings about their activities. Multiple similar websites were discovered, all hosting various types of malware. The scam's persistence mechanisms and social engineering techniques are detailed, along with remediation steps for affected users.