{"id":"MAL-2026-17809","summary":"Malicious code in minecraftaccfinder (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (f519431018ad36a66a7726c8d5ba41ce446a4a6902afdbefbb4de4897eb2f502)\nDuring import, the code installs a persistent inforstealer / RAT. The code first exfiltrates multiple credentials (targeting especially Gmail, Roblox, Discord, and Minecraft) and then opens a port and listens for further C2 commands. It also includes a keylogger, periodic screenshot sending, advanced extracting credentials from browsers, and some detection evasion techniques. In multiple versions the code seems not to be fully functional\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-minecraftaccfinder\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - exfiltration-browser-data\n\n\n - persistence\n\n\n - spyware-like\n\n\n - rat\n\n\n - keylogger\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n","modified":"2026-10-12T10:30:03.797362145Z","published":"2026-10-12T09:29:22Z","database_specific":{"malicious-packages-origins":[{"versions":["0.1.0","0.1.1","0.1.2","0.3.0","0.3.1","0.4.0","2.0.0","3.0.0"],"id":"pypi/2026-10-minecraftaccfinder/minecraftaccfinder","import_time":"2026-10-12T10:24:07.92712969Z","modified_time":"2026-10-12T09:29:22.733744Z","sha256":"f519431018ad36a66a7726c8d5ba41ce446a4a6902afdbefbb4de4897eb2f502","source":"kam193"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/minecraftaccfinder"}],"affected":[{"package":{"name":"minecraftaccfinder","ecosystem":"PyPI","purl":"pkg:pypi/minecraftaccfinder"},"versions":["0.1.0","0.1.1","0.1.2","0.3.0","0.3.1","0.4.0","2.0.0","3.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/minecraftaccfinder/MAL-2026-17809.json"}}],"schema_version":"1.9.0","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}