With the AI wars escalating and new exploits turning up seemingly by the minute, it's easy to forget the older, quieter attack vector: social engineering.
It's a simple idea. Trick a victim into taking an action that compromises the whole system. It's also open to anyone of any skill, and it keeps working.
The script kiddie - Often forgotten about, surprisingly effective.
So my friend recently got hit by a script kiddie and had their entire PC compromised, passwords stolen and login tokens scraped. It was fast and efficient, but surprisingly sloppy.
When I took a look it appeared to be an evolution of a rather old scam in the Minecraft Discord scene.
- A compromised account belonging to a friend messages you.
- They convince you to download a Remote Access Trojan (RAT).
- The RAT steals all your credentials, and your account is now used to try and catch out your friends.
The most recent iteration is to convince people to download files from a trusted modding platform, where the attacker has hosted a trojan JAR file ready to compromise the PC as soon as it is run.
The platform, CurseForge, is trusted and does scan uploads, but scanning isn't a guarantee. A freshly built trojan can slip through, and "it's on the official site" isn't the same as "it's safe". People trust their 'friend' and they trust the platform. They're not even downloading a suspicious ZIP file, just installing a modpack from a trusted platform to play with a 'friend'.
Now when I was looking into the life cycle of this scam it was a little odd. The malicious file seemed remarkably well built and once run, compromised multiple accounts within minutes. All the signs of a decent amount of sophistication. But the actual scam seemed odd. Rather than utilise all the stolen creds and accounts, the 'hacker' contacts the victim via a compromised account and tries to threaten and exploit them for money.
The malicious code turns out to be a somewhat popular piece of malware (tracked here) run by a third party, and it has been doing the rounds for a few months now in one iteration or another.
The malware was well built. The scam wasn't. It turns out those are two different people. Someone else built the tool, and a one-man band is running the social engineering and the extortion on top. That's what a script kiddie is, and it's why they're dangerous. They don't need coding skills, they just need someone else's.
The extortion
This is the part that doesn't fit.
Someone holding saved passwords, login tokens and several accounts has a lot of options. This one chose to message the victim from a compromised account and lean on them for money. That's small-time for what they had, and it points straight back to the script kiddie. The tool did the hard part. My guess is the person using it is making the rest up as they go.
It still works, because it runs on pressure, not skill. Same lever as the first message, get the victim to act before they think.
Why the scam works and why you may be next.
It works because nothing in it looks like an attack.
There's no dodgy email, no misspelt link, no ZIP from a stranger. The message comes from a friend, the file comes from a platform you already use, and installing a modpack is something you've done a hundred times. Every step feels normal, so nobody stops to think.
That's the real exploit. What's being attacked is trust, which skips all the groundwork a normal social engineering attack needs.
- It's a friend, not a pop-up. We're trained to spot suspicious links, we're not trained to doubt our own friends.
- Mods are code. A modpack feels like content, a simple add-on, but a JAR file runs on your PC with permissions most people don't know they have.
- Platforms can check uploads, but "it's on the official site" is not the same as "it's safe".
- Once it runs, passwords and login tokens are gone in minutes, before you've noticed anything odd.
And you don't have to play Minecraft to be next. Swap the modpack for an npm package, a browser extension, a Steam Workshop item, or a "quick look at this" file from a mate. Same pattern, trusted person, trusted place, one click.
What to do about it
None of this needs special skills to defend against. It needs a habit.
- Check with the person, somewhere else. If a friend sends you a file or a link out of the blue, ask them on a voice call or a different app. A compromised account may not be able to answer that.
- Treat a mod like an executable. It runs code on your PC. Check who made it, how long it's been up and whether anyone else is using it before you install.
- Turn on 2FA, but don't rely on it. It helps against stolen passwords, but a stolen login token can skip the login entirely.
- If you've run something dodgy, act fast and from a different device. Change your passwords from a clean device, not the infected PC, otherwise you're handing the new ones straight over. Log out of all sessions on your important accounts, and treat the infected PC as compromised until it's wiped.
- Don't pay, and tell your friends. Their next message from you will look completely real, so they need to know not to trust it.
Everyone is worried about AI right now, about deepfakes and bots that sound human. Fair enough. But what got my friend wasn't clever. It was a message that sounded like a friend, sent from a friend's account.
The check that matters isn't an automated system. It's asking your mate "is this actually you?" before you click.
Leave a Reply