Vulnerabilities

Vulnerability · MAL-2026-17809

Malicious code in minecraftaccfinder (PyPI)

Published Oct 12, 2026 · catalog updated Oct 15, 2026 · Malicious code in minecraftaccfinder

Open the advisory

Exploitation likelihood is not on this record for MAL-2026-17809. A missing EPSS score is not a low risk. Compare Malicious code in minecraftaccfinder with the linked advisory before you change production.

Severity

Unknown—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Not established

Affected products

PyPI minecraftaccfinder

minecraftaccfinder was published to PyPI on 2026-10-12 in six versions within 23 minutes (0.1.2 at 01:05 UTC, 2.0.0, 0.3.0, 0.3.1, 0.4.0, 3.0.0 at 01:28 UTC) with no description, author, README or project page. The package consists of one module, minecraftaccfinder/__init__.py (about 87 KB, 88 functions), installed as the console command . When the command runs it reads the saved logins and session cookies of the browser profiles on the machine, collects the machine's public IP address and account identifiers, and posts the collected data to a chat-service webhook hard-coded in the module. Nothing in the package provides the functionality the name suggests. Versions 0.3.0, 0.3.1 and 3.0.0 were analyzed and carry the same module; 3.0.0 differs from 0.3.1 only in the webhook value. 0.1.2 and 2.0.0 have the same size and were published from the same account minutes apart but were not examined individually, and 0.4.0 is a 949-byte placeholder. The project has since been removed from PyPI. --- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (f519431018ad36a66a7726c8d5ba41ce446a4a6902afdbefbb4de4897eb2f502) During import, the code installs a persistent inforstealer / RAT. The code first exfiltrates multiple credentials (targeting especially Gmail, Roblox, Discord, and Minecraft) and then opens a port and listens for further C2 commands. It also includes a keylogger, periodic screenshot sending, advanced extracting credentials from browsers, and some detection evasion techniques. In multiple versions the code seems not to be fully functional --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-minecraftaccfinder Reasons (based on the campaign): - infostealer - exfiltration-browser-data - persistence - spyware-like - rat - keylogger - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.