Posted on June 15, 2021 at 7:39 PM

Minecraft Fans Should Be Careful Around Mods, Researchers Warn

Researchers at Kaspersky have warned that Minecraft fans should be careful around mods because some of them contain malware.

The researchers say there is a significant rise in the number of dangerous malware masquerading as “Minecraft” mods, mainly on Google Play and Google’s app store.

According to the researcher, it’s not the first time hackers have threat actors have configured their malware to feel like a genuine Minecraft mod, as some of this malware were also discovered last year.

In the previous attack, bogus “Minecraft” modes were delivered on Google Play and they spread like wildfire, sending highly abusive ads and rendering users’ tablets and phones useless.

Malicious files contain an enormous number of ads

The malicious files, although made to look like genuine Minecraft nod, do not add anything to the gamers’ experience, rather they contain an enormous number of adverts, which makes the user’s device unusable.

When they are launched for the first time, they usually hide their icons, making it very difficult for the user to identify and block them.

Security firm Avast discovered that campaign where several malicious Minecraft-themed Android apps were charging their victims $30 a week after they exhaust their free trial period.

The malicious apps frequently open the target’s browser to display ads. They are also capable of launching Google Play app pages and play videos from YouTube, exposing the victim to higher threat levels.

Newly improved malware version

The researchers noted that the Minecraft apps were newly improved versions of the previous malware discovered last year. The improved version opens the device’s browser every few moments to display full-screen ads.

Kaspersky says Google has already been informed about the situation, and the malicious apps have been deleted from the store. However, the researchers still want users to be vigilant and not let their guard down.

Users have been advised to always ensure that the mods and apps they download are from legitimate sites. Also, they should not use unknown or unapproved stores to download apps to their devices since there are more possibilities of downloading malicious apps from those sites. Scammers and hackers have always seen Minecraft fans as targets of malware campaigns.

The “sleeceware” apps offered modifications, colorful wallpapers, and new skins to make them look real. But their main agenda is to deceitfully take funds from users by fronting like genuine apps offering real services.

Over a million Android devices affected

Minecraft is a very popular video game that has attracted millions of game enthusiasts. But it has also attracted the hacking community due to the high number of users playing the game. Kaspersky researchers stated that they noticed a high influx of malicious malware planted in Minecraft nods recently, especially on Google Play.

Kaspersky also said it discovered over 20 malicious modifications between July and November 2020 targeting the Minecraft gaming community. The researchers noted that the malware has already infected over a million Android devices.

However, Kaspersky also explained why attackers keep targeting the gaming nod. According to the researchers, the nod is more vulnerable to attacks because it was designed in Java. As a result, it can be very easy for third-party developers to create mudpacks or compatible apps that claim to enhance or customize users’ gaming experience.

Hackers are monetizing the malicious apps

Kaspersky said the fake mods have their hidden agenda, although they promise to provide more features.

The researchers noted that deletion from Google’s app stores does not necessarily imply that the malware has been defeated. Generally, its developers would simply upload a new, slightly modified version with different developer control accounts and different names.

Kaspersky also said it discovered some Minecraft mudpacks with basic functionality, showing full-screen ads even when the app is not active. However, one of the apps is available as a “basic” version from the store, and the in-app purchase is enabled as well. The researchers noted that their developers are exploring different options to monetize malicious apps.