What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Yes, the campaign was real—but “Stargazers” is shorthand for a malware-distribution operation, not a group of ordinary Minecraft mod developers. Researchers reported that malicious GitHub repositories posing as Minecraft mods, cheats, and automation tools delivered malware to mainly Windows users. The software could target Minecraft credentials and session tokens, browser passwords, Discord and Telegram accounts, cryptocurrency wallets, VPN information, and other sensitive data.
The campaign was reported in June 2025. Available reporting confirms the attack techniques, but does not establish how many Minecraft players were infected, whether the same repositories remain active, or whether the operation is still running at the same scale.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Minecraft | Java & Bedrock Deluxe Collection | Windows Digital Code | $39.99 | Buy on Amazon |
| 2 |
|
Minecraft | Java & Bedrock Ultimate Collection | Windows Digital Code | $49.99 | Buy on Amazon |
| 3 |
|
Minecraft | Standard Edition | XBOX Digital Code | $19.99 | Buy on Amazon |
| 4 |
|
Minecraft | $6.99 | Buy on Amazon |
| 5 |
|
Minecraft - Bedrock Edition PS4 | $42.98 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWho are the “Stargazers”?
Check Point Research calls the wider operation the Stargazers Ghost Network and the suspected threat actor Stargazer Goblin. Those are researcher-assigned names; they do not describe a publicly verified organization with a known membership list.
Check Point described the network as a collection of fake or compromised GitHub accounts and repositories used to distribute malware. It also reported that the network operated as a form of “distribution as a service,” allowing other criminals to use apparently legitimate-looking projects and links to spread malicious software.
#1 Best Overall
- DELUXE COLLECTION — Includes Minecraft: Java & Bedrock Edition, three Bedrock add-ons, three exclusive Character Creator items, and 700 Minecoins.
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that’s unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world filled with surprises.
- SURVIVE THE ADVENTURE — Face mysterious foes, travel across exciting landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play cross-platform with friends in Bedrock Edition on console, mobile, and PC, or join community servers in Java Edition on PC, Mac, and Linux. Online console multiplayer requires a platform-specific subscription (sold separately).
In its broader investigation, Check Point estimated that the network involved more than 3,000 ghost accounts. It inferred that the operation may have begun around August 2022. Those figures are estimates, not an independently verified census. The researchers also estimated revenue of more than $100,000 over the operation’s lifetime, including approximately $8,000 during a monitored period in mid-May to mid-June.
Read Check Point’s investigation into the Stargazers Ghost Network.
How the fake-mod attack worked
The reported attack chain was straightforward:
- A player searched for a Minecraft mod, cheat, automation tool, hack, or utility.
- A GitHub repository was made to look credible using Minecraft terminology, attractive project pages, copied content, releases, and download links.
- Accounts associated with the network added stars, forks, and watches to create artificial social proof.
- The player downloaded and ran a file presented as a mod, installer, or tool.
- A Java-based downloader launched the next stage.
- Additional Java- or .NET-based information stealers were downloaded or executed.
- The malware searched the Windows computer for credentials, browser data, authentication tokens, wallet information, and other sensitive material.
- Stolen information could then be sent to the attackers or used for account takeovers.
The simplified chain is:
Fake GitHub repository → Minecraft-themed Java downloader → information stealer → credential and token theft → account takeover or data theft
Check Point’s reporting linked the broader network to malware families including Atlantida Stealer, Rhadamanthys, RisePro, Lumma Stealer, and RedLine. That does not mean every Minecraft sample used every one of those families. The Minecraft-focused reporting described Java and .NET stealers and a Java-based downloader.
Rank #2
- ULTIMATE COLLECTION — Includes Minecraft: Java & Bedrock Edition, five Bedrock add-ons, five exclusive Character Creator items, and 1000 Minecoins.
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that’s unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world filled with surprises.
- SURVIVE THE ADVENTURE — Face mysterious foes, travel across exciting landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play cross-platform with friends in Bedrock Edition on console, mobile, and PC, or join community servers in Java Edition on PC, Mac, and Linux. Online console multiplayer requires a platform-specific subscription (sold separately).
Why did the repositories look legitimate?
GitHub hosting can create an impression of legitimacy, especially when a project has a polished page and visible activity. The network reportedly exploited several trust signals:
- Familiar mod, cheat, and utility names.
- Copied or cloned repositories.
- Multiple accounts adding stars, forks, and watches.
- Recent bursts of activity that made a project appear popular.
- Download links placed inside otherwise ordinary-looking project pages.
- Possible compromise of legitimate accounts or repositories.
Stars, forks, and watchers are not independent security validation. They can be manipulated, and a repository’s presence on GitHub does not mean its downloadable files have been audited or approved by GitHub.
Recommended Free Tools
Check Point warned that even reputable repositories can be altered to add malicious download links. A suspicious commit that only adds or changes a link deserves particular caution. WIRED reported that GitHub removed accounts violating its policies, but that enforcement does not mean every malicious file or link was eliminated immediately.
What information could be stolen?
The malware was designed to collect more than a Minecraft password. Reported targets included:
Rank #3
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that is unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world full of surprises.
- SURVIVAL ADVENTURES — Face mysterious foes, travel across varied landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play solo or join friends in local split-screen and cross-platform play across console, mobile, and PC. Online multiplayer supports up to 8 players.
- COMMUNITY PLAY — Connect with players on community servers, or subscribe to Realms Plus (sold separately) to play with up to 10 friends on a private server.
| Data | Why it matters |
|---|---|
| Minecraft credentials or account tokens | Potential account takeover and unauthorized game activity. |
| Browser data and saved passwords | Possible access to email, shopping, social, work, and other accounts. |
| Authentication and session tokens | An attacker may access an account without recovering its underlying password. |
| Discord and Telegram credentials | Identity abuse, impersonation, and follow-on phishing. |
| Cryptocurrency-wallet data | Potential theft of funds or wallet secrets. |
| VPN information | Possible access to private services or networks, depending on what was collected. |
| Other application credentials and device information | Additional account compromise or profiling. |
“Steals Minecraft passwords” is therefore directionally accurate but incomplete. A stolen session token can sometimes provide access even when the attacker never learns the password itself. Changing a password is important, but it may not invalidate every stolen session.
Check Point’s threat-intelligence bulletin lists the reported data-collection targets.
Who was most exposed?
The observed campaign primarily concerned Minecraft Java Edition users on Windows who downloaded and executed files from unverified repositories. Risk was especially high for people looking for cheats, hacks, cracked launchers, automation tools, or “free premium” utilities.
Users were at greater risk if they stored passwords in a browser, reused passwords across services, kept cryptocurrency wallets on the computer, or ran an unfamiliar file with administrator privileges.
Rank #4
- Skins! We have biome settlers, city folk, town folk, and more!
- The Nether and all its inhabitants. Fight Ghasts and make friends with Pigmen
- Cross platform play for up to five players between Pocket Edition and Windows 10
- Revamped touch controls, controller support, and a controller mapping screen
- Enhanced Weather effects! Accumulating snow and more
The cited reporting does not establish that the same samples affected every Minecraft edition or operating system. It does not prove that Bedrock consoles, mobile devices, Xbox, PlayStation, Nintendo Switch, or Linux systems were affected by this particular campaign. Similar distribution methods could potentially be adapted to other platforms, but that is not evidence of impact here.
How to check a Minecraft mod before downloading it
Use this checklist before running any mod or related tool:
- Prefer established mod platforms and known developer release pages. Follow links from a developer’s verified website or established project identity rather than a random search result.
- Inspect the project history. Look at the repository owner, release history, issues, documentation, and whether the development record is consistent rather than a sudden burst of activity.
- Be cautious with standalone executables. A project that only offers an executable or sends you to an unexplained external download is higher risk.
- Treat cheats and cracked tools as high-risk. Promises of free premium features, urgent updates, or exclusive hacks are common malware lures.
- Do not disable security protections. Never turn off Microsoft Defender, SmartScreen, or browser warnings simply to run a mod.
- Do not enter your Microsoft password into an untrusted prompt. A launcher or website reached through a suspicious download should not be trusted with account credentials.
- Verify releases and hashes when available. Compare the file with the developer’s official release and check a published hash if one exists.
- Confirm compatibility. Legitimate mods commonly identify the Minecraft version, loader—such as Fabric, Forge, or NeoForge—and required dependencies.
- Understand the installation behavior. Many legitimate Java mods are placed in a
modsdirectory rather than requiring an unknown installer, although this is not an absolute rule. - Use the least privilege possible. Do not run an unknown file as administrator.
- Keep software updated. Update Windows, Minecraft, Java, browsers, and security software.
File extensions alone are not enough. A malicious program can imitate a normal .jar file, while some legitimate tools use installers. Source provenance and expected behavior matter more than the extension.
What to do if you already ran a suspicious file
A downloader may retrieve additional components or establish persistence. That is why password changes, session revocation, device cleanup, and possibly a clean reinstall all matter. A password change by itself is not a complete response to possible token or browser-session theft.
Best Value
- Play and share with friends on console, mobile and Windows 10
- discover community creations in the new in-game store
- access new mini games and game modes through servers
How to look for account abuse
From trusted devices, review:
- Microsoft account recent activity and unfamiliar devices.
- New security methods, recovery addresses, or authenticator registrations.
- Minecraft profile changes, unfamiliar purchases, or unexpected multiplayer activity.
- Discord and Telegram login sessions.
- Browser password-manager activity and saved-password access.
- Cryptocurrency-wallet transactions.
- Email forwarding rules and unexpected password-reset messages.
- Antivirus detections, unfamiliar programs, and unexplained startup entries.
An unfamiliar login does not by itself prove that Stargazers caused it. Attribution requires technical evidence, but any unexplained activity is a reason to secure the account immediately.
Free tools Windows power users keep installed
One-click scans. No signup required.
What remains unknown
The cited reporting confirms the campaign and its methods, but it does not establish:
- The number of confirmed Minecraft victims.
- The current number of active repositories.
- Whether the same repositories or accounts remain active.
- Whether every sample used the same downloader or malware family.
- Whether a particular reader’s device was infected solely because a repository showed similar activity patterns.
- Whether the operation is still active at the same scale as the 2025 reporting.
Reports that a sample initially evaded detection in a testing environment are also time-specific. They do not prove that antivirus software is useless or that the same file remains undetectable. Broadcom’s bulletin summarizes the June 2025 campaign, while PC Gamer reported on the detection-evasion context.
Bottom line
The Stargazers campaign was a real malware operation that used Minecraft-themed GitHub downloads as a lure. Its reported targets went well beyond Minecraft passwords, including browser credentials, authentication tokens, chat accounts, VPN information, and cryptocurrency wallets. A repository’s stars, forks, watchers, or gaming-themed branding cannot replace trusted provenance, current security software, and careful account protection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
