The Ghost in the Mods: How Stargazers Network is Hacking Minecraft Players

A sophisticated multi-stage malware campaign is targeting Minecraft players through a Distribution-as-a-Service (DaaS) model known as the Stargazers Ghost Network, which operates via GitHub. The campaign exploits user trust by distributing malicious Java files disguised as popular game mods, such as Oringo and Taunahi. Its ultimate goal is financial theft and data exfiltration, stealing browser data, cryptocurrency wallets, VPN credentials, and system information. All harvested information is transmitted to a Discord webhook, posing serious risks to both victims’ finances and privacy.