---
id: MAL-2026-17809
title: Malicious code in minecraftaccfinder (PyPI)
summary: Malicious code in minecraftaccfinder (PyPI)
severity: critical
exploited: true
vendor: minecraftaccfinder
product: minecraftaccfinder
ecosystem: pip
affected:
  - minecraftaccfinder
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T10:30:03.797362145Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-17809'
references:
  - url: 'https://bad-packages.kam193.eu/pypi/package/minecraftaccfinder'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-10-13T11:45:30.147Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (f519431018ad36a66a7726c8d5ba41ce446a4a6902afdbefbb4de4897eb2f502)
During import, the code installs a persistent inforstealer / RAT. The code first exfiltrates multiple credentials (targeting especially Gmail, Roblox, Discord, and Minecraft) and then opens a port and listens for further C2 commands. It also includes a keylogger, periodic screenshot sending, advanced extracting credentials from browsers, and some detection evasion techniques. In multiple versions the code seems not to be fully functional


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-minecraftaccfinder


Reasons (based on the campaign):


 - infostealer


 - exfiltration-browser-data


 - persistence


 - spyware-like


 - rat


 - keylogger


 - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.


## Affected packages

- `minecraftaccfinder`

## Remediation

Refer to the advisory for the patched release.