minecraftaccfinder

GHSA-gw9m-gc3w-389x

Malicious code in minecraftaccfinder (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

## Source: kam193 (f519431018ad36a66a7726c8d5ba41ce446a4a6902afdbefbb4de4897eb2f502)
During import, the code installs a persistent inforstealer / RAT. The code first exfiltrates multiple credentials (targeting especially Gmail, Roblox, Discord, and Minecraft) and then opens a port and listens for further C2 commands. It also includes a keylogger, periodic screenshot sending, advanced extracting credentials from browsers, and some detection evasion techniques. In multiple versions the code seems not to be fully functional


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-minecraftaccfinder


Reasons (based on the campaign):


 - infostealer


 - exfiltration-browser-data


 - persistence


 - spyware-like


 - rat


 - keylogger


 - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/eef8c13ae4254f38564f71de814bbc86a2bc1799/osv/malicious/pypi/minecraftaccfinder/MAL-2026-17809.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/minecraftaccfinder
- https://github.com/ossf/malicious-packages/blob/eef8c13ae4254f38564f71de814bbc86a2bc1799/osv/malicious/pypi/minecraftaccfinder/MAL-2026-17809.json
- https://github.com/ossf/malicious-packages/blob/2ffdaaaa9c7a4c17277ddfe53a6608b0e54fbc31/osv/malicious/pypi/minecraftaccfinder/MAL-2026-17809.json
- https://github.com/advisories/GHSA-gw9m-gc3w-389x

Compromised versions (1)

= 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.