Eric Parker exposed a PC infection scheme through Minecraft mods: what every player needs to know

If you play Minecraft with mods, this article is for you. Cybersecurity specialist Eric Parker has published a detailed breakdown of several computer compromise schemes aimed specifically at Minecraft Java Edition players. The threat is real, widespread, and, most troubling of all, almost invisible at first glance.

Who is Eric Parker and how did he uncover the scheme

Eric Parker is an information security researcher who runs a popular YouTube channel where he explains real cyber threats in simple, clear language. He had previously reported on malicious mods distributed through CurseForge and Modrinth. This time, Parker published a detailed analysis of two new attack schemes targeting Minecraft players. Both cases share one thing: the attackers skillfully exploit the gaming community’s trust in familiar tools — mods and servers.

Scheme one: a vulnerability in Litematica

On July 6, 2026, a critical vulnerability was disclosed in the popular client-side mod Litematica, used by millions of players for working with schematics. The issue affects all versions of the mod for Minecraft 1.21 and above.

The core of the vulnerability is the lack of validation for incoming data when receiving files from a server. When a player joins an infected server, it initiates a file transfer disguised as a normal schematic. The client accepts the data without any verification and without restricting the write path. As a result, the malicious file can be written to any folder on the disk — including system directories and startup folders.

If the written file is executable, it enables remote code execution (RCE). The vulnerability can be triggered even without the related Servux mod installed on the server — a single specially crafted data packet is enough. The developers have already released a patch, but users who have not updated their setup remain at risk.

Scheme two: the QualityCraft mod and a malicious resource pack

The second scheme is even more sophisticated — both socially and technically. It starts on Discord, where users are invited to test a new game server and told to install the QualityCraft mod from CurseForge. The mod looks completely legitimate and passes automated moderation without issues because, at the installation stage, it actually does nothing malicious.

The trap is triggered later. When the player connects to the target server, they are prompted to download the server’s resource pack. In a clean game client, this pack is completely harmless. But if QualityCraft is installed, it launches a hidden execution chain:

• Code hidden beyond the archive’s standard header is extracted from the resource pack
• VBScript scripts are executed
• A command file named update.bat is downloaded, followed by the reverse shell rev.bat
• Remote access trojans Quasar RAT and PureHVNC, along with a password-stealing program, are installed on the computer

At the time of discovery, Windows Defender responded weakly to the threat: the malicious activity is spread across several download stages, which makes detection much harder.

What players stand to lose

The consequences of infection are extremely serious:

• Data theft: browser cookies, saved passwords, Discord tokens, Wi‑Fi passwords
• Account loss: all stolen information is automatically sent to the attackers through Discord webhooks
• Full remote access to the PC: screenshots, file management, hidden tasks in Windows Task Scheduler

If you installed QualityCraft and downloaded a resource pack from a suspicious server, it is recommended to check startup entries using Autoruns or perform a full system reinstall. The malicious files use fixed names (for example, WidgetService.exe), which makes them easier to find.

Conclusion: vigilance is the best defense

Both schemes have one thing in common: they exploit not only technical vulnerabilities, but also players’ trust. The attackers act friendly, patiently build trust, and operate in stages — which is exactly why they are so hard to spot.

Update your mods, do not install software at the request of strangers on Discord, and keep up with security news — including analyses like Eric Parker’s.

Have you ever come across suspicious mods or servers? Share your experience in the comments — let’s figure it out together.