Malicious code in minecraftaccfinder (PyPI)

Overview

-= Per source details. Do not edit below this line.=-

Source: kam193 (f519431018ad36a66a7726c8d5ba41ce446a4a6902afdbefbb4de4897eb2f502)

During import, the code installs a persistent inforstealer / RAT. The code first exfiltrates multiple credentials (targeting especially Gmail, Roblox, Discord, and Minecraft) and then opens a port and listens for further C2 commands. It also includes a keylogger, periodic screenshot sending, advanced extracting credentials from browsers, and some detection evasion techniques. In multiple versions the code seems not to be fully functional

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-minecraftaccfinder

Reasons (based on the campaign):

• infostealer

• exfiltration-browser-data

• persistence

• spyware-like

• rat

• keylogger

• The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

Affected packages

• minecraftaccfinder

Remediation

Refer to the advisory for the patched release.