'STARGAZERS' USE FAKE MINECRAFT MODS TO STEAL PLAYER PASSWORDS

Summary from the TLDR InfoSec newsletter

Check Point Research discovered a campaign conducted by the Stargazers Ghost Network that leverages approximately 500 different GitHub repositories to target Minecraft players with trojanized and malicious mods. The mods contain a JAR loader which downloads the Java-based stealer from Pastebin. The stealer attempts to steal Minecraft account tokens, data from popular third-party launchers, and Discord and Telegram account tokens before acting as a loader for a traditional info stealer which attempts to steal information from web browsers, VPN account data, cryptocurrency wallets, etc.