c--617b5f35-...-prod.lovable.cloud: fake Minecraft cheat-client .jar files tagged SilentNet, and what to do on a Windows PC

What this address is, and what we know about it

This is not a program on your PC. It is a web address in the lovable.cloud domain that the abuse.ch project URLhaus lists as a place where malware was downloaded from. We found no public write-up of this one address, so this page separates what URLhaus shows, what we checked ourselves, and what researchers have published about the malware family named in the tags.

1. 1

   What URLhaus lists

   Three file addresses under a storage path called mod-files, in three folders: krypton-client, meteor-client and opsec. They were added on 12 October 2026 between about 19:09:08 and 19:09:13 UTC by the reporter NyxIndius. All three carry the threat label malware_download, the tag SilentNet, and are marked offline.

2. 2

   What the file names suggest

   Meteor Client is a well known cheat client for Minecraft Java Edition, and 1.21.11 is a Minecraft version number. Krypton and opsec read like names of similar add-ons. The names are what the uploader chose, so they prove nothing about the content. Fake copies of popular Minecraft clients are the pattern the researchers below describe.

3. 3

   What we could not confirm

   We did not download any of the files, so we cannot say what is inside them or where they send data. URLhaus shows tags, not a proof. We also do not know who runs the page that handed out these links or how visitors were led to it.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a browser warning or an alert, you are not infected by that alone. The risk is for a PC where someone downloaded one of these .jar files and started Minecraft with it. If the name came from a log, find the device that asked for it.

Kind of threat

Download address for Minecraft client .jar files tagged SilentNet, a family that MalwareBazaar samples describe as a stealer

Where the files were

hxxps://c--617b5f35-a107-4800-9047-a429934c0483-prod[.]lovable[.]cloud/storage/v1/object/sign/mod-files/... (signed download links; the long token is left out here on purpose)

Parent domain registered

lovable.cloud was registered on 12 September 2025 through Cloudflare (RDAP, read 12 October 2026). That is the platform's domain, not the age of this one project address

URLhaus entries

3 file addresses, all added 12 October 2026, all offline when we read them

Link lifetime

Each link carries a signed token. Its readable part gives the file path, the scope download and a lifetime of 600 seconds (10 minutes)

Platform

Windows is the main case: Minecraft Java Edition runs .jar mods on every desktop system, but the vendor write-ups we read describe Windows. We found no source for Mac or Linux behaviour of these files

What we checked on 13 October 2026, and what we could not

Our check was one plain request from our server to the address, with no browser and no clicks. It returned HTTP 404 from a Cloudflare server. That clears nothing: a signed download link stops working after its lifetime, so a 404 is what any such link gives later.

Timeline: from the parent domain to the reports

The reports are one day old at the time of writing. The dates come from RDAP and the URLhaus data we hold; the times are UTC.

1. 12 September 2025

   lovable.cloud is registered

   RDAP shows the domain lovable.cloud registered on 12 September 2025 through Cloudflare, with the status client transfer prohibited. This is the platform's domain that many separate projects use as a hosting address, so it says nothing about who made this particular project.

2. 12 October 2026, about 19:07 UTC

   The download links are issued

   The tokens in the three links carry issue times of a few minutes before the reports, and each expires 600 seconds later. This is our reading of the token's readable part, not something URLhaus states.

3. 12 October 2026, 19:09 UTC

   Three files are reported

   At 19:09:08 the opsec file is added, and at 19:09:13 the meteor-client and krypton-client files. All three are tagged SilentNet and marked offline.

   

4. 13 October 2026

   Our check

   A plain request from our server gets HTTP 404 from Cloudflare. We make no claim beyond that.

What the pattern suggests, and what it does not: three differently named clients stored in one bucket and reported within five seconds looks like one collection of fake clients, not three accidents. That is our reading of the dates and names. No report says who is behind it.

What SilentNet is, according to the researchers

SilentNet is a label that abuse.ch's MalwareBazaar puts on Java samples that pose as Minecraft cheat clients and mods. We did not open the files from this address, so the table says what the published samples show, not what these three files contain.

How a fake client file ends up running on a PC

A .jar file is a Java program. It does nothing while it sits in your Downloads folder; it works when Minecraft loads it as a mod or when you start it with Java. That is the step a victim takes themselves, and it is why the stories always begin with someone looking for a free cheat client.

1. 1

   The lure

   Check Point, as summarised by CyberInsider, found fake cheat mods that copied real names and were hosted in GitHub repositories padded with fake star accounts. The MalwareBazaar notes for a fake Meteor Client point to a lookalike website that imitates the real one. Either way the victim chooses to download.

2. 2

   The download link

   The links reported here are signed storage links. A signed link works only for a short time, so the page that hands it out can create a new one for every visitor. This also makes the file harder to find afterwards, which is why URLhaus shows them offline.

3. 3

   The mods folder

   The player puts the .jar into the mods folder or runs it as a launcher. Fabric then loads it when the game starts. Nothing needs administrator rights, because the file runs as the player.

4. 4

   Loader checks

   The Check Point loader exits if it sees virtual machines or analysis tools such as Wireshark, and runs only where Minecraft is installed. That helps it avoid sandboxes. Whether SilentNet files do the same is not known.

5. 5

   The theft

   The stealers in the reports collect session tokens, saved logins and more, then send them out by HTTP or a Discord webhook. The next section lists what the sources name.

Because the whole chain runs inside a trusted program (Java and Minecraft), a quiet game window means nothing. The theft takes seconds.

What a Minecraft stealer can take from a PC

The list below comes from Check Point's June 2025 campaign and from the SilentNet sample notes. We do not know that these three files do all of it. It shows what to protect.

What this can cost you

Reading this name costs nothing. The risks below apply to a PC where one of these .jar files was started.

• High

  Accounts taken over

  A stolen Discord or Microsoft token can be used without your password. The attacker can then message your friends from your account with the same bait.

• High

  Passwords typed or saved on the PC

  Saved browser logins are on the list of stolen items. Changing them from the infected PC does not help if something is still watching.

• High

  Crypto wallets

  Wallet files and data are named by Check Point. Money sent from a stolen wallet cannot be taken back.

• Medium

  More malware on the same PC

  The SilentNet notes describe downloading and running further code, so the first file may only be the door.

• Medium

  Children and teenagers

  Cheat clients are mostly sought by younger players, who often use the family PC with the parents' browser logins. Check the whole PC, not only the game.

• Low

  Nothing, if you only saw the name

  A name in a log, a block list or a warning is not an infection.

What you may notice, and what you may not

Stealers are built to be quiet. The signs below follow from the sources; none is certain and many victims notice nothing.

Who can meet this, and how

Almost nobody opens such an address by hand, and the links last ten minutes. The people at risk are those who went looking for a Minecraft cheat client, a performance mod or a free copy of a paid one, and downloaded from a source that was not the official site.

1. 1

   You downloaded a client or mod from a search result, video link or Discord invite

   Lookalike sites copy the real one. The real Meteor Client is distributed from its own site, and the MalwareBazaar notes name a lookalike. Check the address you came from.

2. 2

   A friend or server sent a file

   A hacked Discord account sends the same files to friends. A .jar sent in a chat is the most common way the next victim is reached. We have no number for how often this happens.

3. 3

   You only saw the name in a log

   A device on your network asked for this address. That device, not every device, is the one to check. If it was a child's gaming PC, start there.

If you own a Lovable project, or you think your own site was used

The address is a Lovable Cloud project address, which means an account holder, or someone who took over an account, stored these files there. Lovable Cloud is built on Supabase technology, and the path in the links (storage/v1/object/sign) is the usual storage path for signed downloads. That is a platform fact, not an accusation against Lovable or its customers.

1. 1

   Look in the storage of your project

   If this project is yours, open its storage and look for a bucket named mod-files with folders krypton-client, meteor-client or opsec. If you did not create them, treat the project as taken over.

2. 2

   Change the keys and the sign-in

   Reset your Lovable password, turn on two step sign-in, and rotate any API keys and database keys that were shown in the project. We could not find Lovable's own abuse page in our research, so we give no link; look in your account and help pages.

3. 3

   Delete the files and report

   Remove the files, check who has access, and tell the platform. If you are not the owner and you found these links, report the address to URLhaus and to the platform's support.

4. 4

   What we do not know

   We do not know if the project is a throwaway made for this, or a real project that was abused. The public record is silent on both.

Check your PC before you delete anything

Start with one question: did you or anyone on this PC download a Minecraft client, add-on or .jar file from outside the official site, and start the game after? If yes or not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, Discord or crypto. Disconnect it from the network if you can.

1. 1

   Close Minecraft and disconnect

   Quit the game and the launcher, then turn off Wi-Fi or unplug the cable. A stealer that is still running needs the connection to send data.

2. 2

   Read the mods folder

   Press Windows key + R, type %appdata%\.minecraft\mods and press Enter. Write down every .jar you do not recognise and where it came from. Do not run them. Launchers such as Prism keep their own folders, so check there too.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time you downloaded the file. Microsoft says Defender Offline results also appear there.

4. 4

   Look at Task Manager

   Open Task Manager and the Processes tab with Minecraft closed. A javaw.exe (Java) entry still running is worth a look; right-click it and choose Open file location. Java is a real program, so this is a hint, not proof.

5. 5

   Check what starts with Windows

   Open Settings > Apps > Startup and look for names you did not install. The SilentNet notes describe a hidden relaunch; we found no source that names a startup entry for these files, so a clean list does not clear the PC.

6. 6

   Check your accounts from another device

   Open the sign-in activity of your Microsoft, Discord, email and Steam accounts, and look at crypto balances. This is quicker than any file check.

7. 7

   A scan helps, but it does not clear the PC

   Microsoft Defender or another scanner can find known files, but Java archives are not always flagged. Treat a clean result as one data point. We infected no PC, so the order of this plan is our judgement from Microsoft's pages and the community notices, not a tested result.

If you use a Mac, Linux, an iPhone or an Android phone

Minecraft Java Edition runs on Mac and Linux, and a .jar mod is not tied to Windows. The sources we read describe Windows though, and we found nothing on these three files for other systems.