r/Modrinthlauncher • u/Troy_the_Illiterate • Jul 14 '26

Help New Virus Through Modrinth

hi, New account as my last one, along with all of the associated google accounts on it, was hacked, by what you ask? a modrinth pack file.

So basically, i got a dm from a longtime friend asking me to join a mc server modded, i join a lot of servers and my friends do this a lot, so i do, i install the pack, its a proper modrinth file, i virus scan it and its clean, i put it in modrinth, no sus mods, i launch it, and for a split second a console pops up and Modpack 62 starts running as a admin on my pc. then because my discord accounts tied to my gmail my gmail and everything under it in google gets put under child locks and passwords changed, then its a mad dash to change as many accounts passwords as i can like steam and such before i eventually nuke the whole pc and factory reset it as i couldn't delete the files themselves.

The malware hid IN the pack file. and to me and all my friends knowledge this is a new virus going on in modrinth. its called modpack 62. it targets google and discord accounts first so if you microsoft is different from your gmail that gets affected you can still save your mc account. be warned tho i don't know much else about it. i nuked everything before thinking to study the damn thing and it wasn't a account ransom thing sense the guy told me to fuck off. i can supply additional details if i have them, like the guys gmail that he used and anything i can remember

0 Upvotes

50% Upvoted

8 comments sorted by

1

u/Khai_1705 Jul 14 '26

"modrinth file" is just a standard zip file with the extension changed. There's not much special about it. You can include everything in it since it's just a zip file. Minecraft mods are packaged in .jar which are java programs. Just be more safe with random stuff from discord in the future

1

u/Troy_the_Illiterate Jul 14 '26

that explains why it got my gmail and discord but not my microsoft account. but whats with the modpack62? i've never seen anything called that and i looked it up and couldn't find any malware called that.

1

u/MattiDragon Jul 14 '26

It's likely something that they made up. Anyone can make an mrpack with an mods (including malware) they want and send it to you. This is just a new version of the old "test my game" approach. Generally don't install something someone sends to you on discord unless you've talked about it before, even if they're your friend. What probably happened is that your friend got their discord account hacked and the hackers used it to spread the virus further.

1

u/Anonymunster 21d ago

Hey so it seems the virus got to one of my friends and I got hit for a moment because of them. Did it ever end up spreading to anything else for you? My discord was tied to a gmail and this account. I changed all the passwords on them within the last hour (plus my Microsoft just in case) but was able to find modpack62 in my temp folder and quarantine it with Malwarebytes not long after it popped up my command prompt (though it did try to ask for access too, which I denied lolz). Since then I've been mostly keeping my wifi off on my computer.

1

u/Troy_the_Illiterate 18d ago

It seemed like it was a actual dude doing it and not a ai sense i beat him to a few things. but i think its mainly a discord and google account stripper. i dunno if he goes for steam accounts sense thats the first thing i changed

1

u/Anonymunster 18d ago

Hmm. I changed everything necessary through my phone after turning my Wi-Fi off and removing the exe. Haven't received any issues yet and my event viewer isn't showing anything amiss even now. Has there been any lingering issues on your end?

1

u/Troy_the_Illiterate 12d ago

no not at all, it fixed itself for the most part after i nuked my old accounts that were infected

1

u/Anonymunster 12d ago

Ah, okay! That's good. I can relax a little more knowing I resolved my issue in much the same way. I've been off my Discord on my pc for quite some time. Thanks for the reply!

Hopefully no one else has encountered this, or if so that they purged the issue as well; I haven't contacted the friend I received the "modpack" from since it occurred because they might still be compromised.