MAL-2026-17809

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/minecraftaccfinder/MAL-2026-17809.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17809
Published
2026-10-12T09:29:22Z
Modified
2026-10-29T13:48:11Z
Summary
Malicious code in minecraftaccfinder (PyPI)
Details

minecraftaccfinder was published to PyPI on 2026-10-12 in six versions within 23 minutes (0.1.2 at 01:05 UTC, 2.0.0, 0.3.0, 0.3.1, 0.4.0, 3.0.0 at 01:28 UTC) with no description, author, README or project page. The package consists of one module, minecraftaccfinder/init.py (about 87 KB, 88 functions), installed as the console command minecraftaccfinder. When the command runs it reads the saved logins and session cookies of the browser profiles on the machine, collects the machine's public IP address and account identifiers, and posts the collected data to a chat-service webhook hard-coded in the module. Nothing in the package provides the functionality the name suggests. Versions 0.3.0, 0.3.1 and 3.0.0 were analyzed and carry the same module; 3.0.0 differs from 0.3.1 only in the webhook value. 0.1.2 and 2.0.0 have the same size and were published from the same account minutes apart but were not examined individually, and 0.4.0 is a 949-byte placeholder. The project has since been removed from PyPI.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ff6c862c09de4144ac1bcaf5db6036c26285ccc3b5f9112cb0b918388949fbb6)

The package name advertises discovery of Minecraft accounts, a purpose that is inherently credential-adjacent and that routinely corresponds to token/session theft tooling targeting the installing user. Automated tracing of the package's source engaged with the files but the model's output was withheld by the provider safety filter, a response pattern that occurs when traced content reads as operational credential-theft or malware code rather than benign functionality. Combined with the stated purpose and the absence of any legitimate account-finder design (no documented API, no account-owner authentication flow), the package shape is consistent with harvesting Minecraft/Mojang/Microsoft session artifacts from the installer and exfiltrating them.

Source: kam193 (f519431018ad36a66a7726c8d5ba41ce446a4a6902afdbefbb4de4897eb2f502)

During import, the code installs a persistent inforstealer / RAT. The code first exfiltrates multiple credentials (targeting especially Gmail, Roblox, Discord, and Minecraft) and then opens a port and listens for further C2 commands. It also includes a keylogger, periodic screenshot sending, advanced extracting credentials from browsers, and some detection evasion techniques. In multiple versions the code seems not to be fully functional

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-minecraftaccfinder

Reasons (based on the campaign):

  • infostealer

  • exfiltration-browser-data

  • persistence

  • spyware-like

  • rat

  • keylogger

  • The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

Database specific 
{
    "iocs": {
        "domains": [
            "api.ipify.org",
            "discord.com"
        ],
        "files": [
            {
                "digests": {
                    "sha256": "7a6b7cf950ef472eff134a08278e2a7794f7666d5e51d76c39784f0e77b4c6e6"
                },
                "note": "payload module of 0.3.1: reads browser credential and cookie stores, collects the public IP address, posts the data to a hard-coded webhook URL (the URL is in the module)",
                "paths": [
                    "minecraftaccfinder/__init__.py"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "806593c84dc67087cf857ef05cb918dbc9df5348d7d56522e18bb420847e28c2"
                },
                "note": "payload module of 0.3.0, same behavior",
                "paths": [
                    "minecraftaccfinder/__init__.py"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "89f4148533676173ddeac9dac0bf0fa1656cd855adbfbc5b0665ae0c50e7fc49"
                },
                "note": "payload module of 3.0.0, same behavior; differs from 0.3.1 only in the webhook value",
                "paths": [
                    "minecraftaccfinder/__init__.py"
                ],
                "source": "PACKAGE_ARCHIVE"
            }
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-minecraftaccfinder/minecraftaccfinder",
            "import_time": "2026-10-12T10:24:07.92712969Z",
            "modified_time": "2026-10-12T09:29:22.733744Z",
            "sha256": "f519431018ad36a66a7726c8d5ba41ce446a4a6902afdbefbb4de4897eb2f502",
            "source": "kam193",
            "versions": [
                "0.1.0",
                "0.1.1",
                "0.1.2",
                "0.3.0",
                "0.3.1",
                "0.4.0",
                "2.0.0",
                "3.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-021939",
            "import_time": "2026-10-29T13:37:17.348716294Z",
            "modified_time": "2026-10-29T13:27:43Z",
            "sha256": "ff6c862c09de4144ac1bcaf5db6036c26285ccc3b5f9112cb0b918388949fbb6",
            "source": "amazon-inspector",
            "versions": [
                "0.1.2"
            ]
        },
        {
            "id": "IN-MAL-2026-021943",
            "import_time": "2026-10-29T13:37:17.477857787Z",
            "modified_time": "2026-10-29T13:28:15Z",
            "sha256": "56239ad5837778d1e811b7a7bd46387dc6787cf21299f1c6d171030f509da8bf",
            "source": "amazon-inspector",
            "versions": [
                "2.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-021940",
            "import_time": "2026-10-29T13:37:17.385887616Z",
            "modified_time": "2026-10-29T13:27:49Z",
            "sha256": "77e2cae8f471287d1bedcb629180e6b4f6dbcfa8cea7e55764e64ddbbb836cc7",
            "source": "amazon-inspector",
            "versions": [
                "3.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / minecraftaccfinder

Package

Name
minecraftaccfinder
View open source insights on deps.dev
Purl
pkg:pypi/minecraftaccfinder

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.3.0
0.3.1
0.4.0
2.*
2.0.0
3.*
3.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "minecraftaccfinder-0.1.2-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "251dea19e5bfe0e9fffff814442c712f905392cf7ab2c4bd5d26384cd8d01aa1",
                "md5": "e3546b496af059e0cb19b7f37d8a3aa2",
                "sha256": "1c4d8f4e2e20d9009d6de6bbf6721a642de4565efbc4976b3e49139405ad87c5"
            }
        },
        {
            "filename": "minecraftaccfinder-0.1.2.tar.gz",
            "hashes": {
                "blake2b_256": "11a124d57bfbd9ec10b7a8d840238fb141df276f10b37316f758dea2b26e13a1",
                "md5": "db17701fa7c92aad8d85120967bf0d41",
                "sha256": "67b880609db59e17cf282304dbf198260868aeca8873ae7f90fb31eea1517cc0"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/minecraftaccfinder/MAL-2026-17809.json"