donutclients.st: a Minecraft mod site whose 30 .jar files URLhaus tags as stealers, and what to do if you ran one on Windows

What donutclients.st is, and what we know about it

donutclients.st is not a program on your PC. It is a web address that presents itself as a download page for Minecraft mods, and the abuse.ch project URLhaus lists every one of the 30 .jar files we hold for it as a malware download tagged stealer. We found no public write-up of this one address, so what follows is what URLhaus shows, what our server saw on one plain request, and what security researchers have published about malicious Minecraft mods in general.

1. 1

   What URLhaus lists

   Thirty file addresses on donutclients.st, all in the top folder of the site and all named like a mod plus the version 26.2 and the ending .jar. They were added on 7 October 2026: 29 of them between 04:41:06 and 04:41:31 UTC and the last one, TotemCounter-26.2.jar, at 04:55 UTC. Every entry has the threat label malware_download and the reporter name wok. When we read our copy of the data, all 30 were marked offline.

2. 2

   What the tags mean

   jar means a Java archive, the format Minecraft mods use. java names the language. stealer means the reporter believes the file steals data such as passwords and sessions. The fourth tag, vm, appears on every entry, and we do not know what the reporter meant by it. It may refer to the way the file behaved in a test machine, but that is a guess and we do not rely on it.

3. 3

   What the file names tell you

   Many names copy well known mods or mod menus: Sodium, Lithium, Iris, FerriteCore, Litematica, WorldEdit, Baritone, Xaeros_Minimap, appleskin, Mouse_Tweaks and meteor-client among them. Others look like cheat clients: krypton-client, radium-client, glazed-client, bamboo-client. We are not saying the real projects with those names are harmful. We are saying that the files served from this address under those names are the ones URLhaus lists, and the real projects are published on their own sites.

4. 4

   What we could not confirm

   We did not download any of the files, so we cannot tell you which stealer family is inside, what it takes, or where it sends the data. The tags are a reporter's label, not a proof, and we have no Microsoft detection name for these files. We also cannot tell whether the site's owner knows about it, whether the site was built to spread malware, or whether someone swapped the files on a real mod page.

Kind of threat

A mod download site whose 30 reported .jar files are tagged stealer, java and vm by URLhaus

Where the files are

hxxps://donutclients[.]st/NAME-26.2.jar, for example hxxps://donutclients[.]st/Sodium-26.2.jar. Plain file names in the root of the site

Domain registered

Unknown. Our registration lookup (RDAP) returned no record for the .st domain on 7 October 2026, so we cannot give a date or a registrar

URLhaus entries

30 file addresses, all added on 7 October 2026 (04:41 to 04:55 UTC); all 30 offline in our copy of the data

Home page

Answered with HTTP 200 on 11 October 2026 behind Cloudflare, with the title DonutClients, 30+ Free DonutSMP Mods for Fabric 26.2

Platform

Windows is the main case. Java mods can also run on Mac and Linux, and we found nothing that limits these files to Windows. Phones are not affected, because Minecraft Java mods do not load there

What we checked on 11 October 2026, and what we could not

Our check was one plain request from our server: no browser, no clicks, no download. The home page answered, so the site is not simply gone. That clears nothing, because the danger rating comes from what URLhaus reports about the files, not from a home page.

What happened to donutclients.st, as far as the data shows

Everything we hold is from a few days: 30 reports within about 15 minutes on 7 October 2026, and one check of ours four days later. Times are UTC. We have no record of the site before that.

1. Before 7 October 2026

   Registration date unknown

   Our registration lookup found no record for donutclients.st, so we do not know when the domain was registered or by whom. The .st top level domain belongs to Sao Tome and Principe. That is a fact about the ending, not a sign of anything by itself.

2. 7 October 2026, 04:41 UTC

   A burst of 29 mod files is reported

   Between 04:41:06 and 04:41:31 the reporter wok adds 29 files in about 25 seconds, from WorldEdit-26.2.jar and ExploitPreventer-26.2.jar to meteor-client-26.2.jar, alycone-client-26.2.jar and radium-client-26.2.jar. All carry the tags jar, java, stealer and vm.

   

3. 7 October 2026, 04:55 UTC

   A last file: TotemCounter

   TotemCounter-26.2.jar is added at 04:55:41 with the same four tags. Together with the earlier burst this makes 30 entries. The speed of the reports looks like someone going through the site's whole download list in one pass, which is our reading of the timestamps, not something a report says.

4. 11 October 2026

   Our check

   Our server asks for the home page once. It answers with status 200 and the title DonutClients, 30+ Free DonutSMP Mods for Fabric 26.2. We do not download files. The 30 entries are still marked offline in our copy of the data.

What the pattern suggests, and what it does not: every file has the same version number, 26.2, which matches the title of the page. That fits a site that built one complete mod pack and put every file under one version label. It does not tell us whether the files were made malicious by the site owner, by someone who broke into the site, or by a copy of the mods that was altered before the site got it.

How a Minecraft mod can steal from a PC

A .jar mod is not a picture or a document. It is a program that Minecraft loads and runs with your Windows rights the moment the game starts. Nothing needs to be clicked in a pop-up. This is how Check Point Research and G Data describe the technique; we did not see the files from donutclients.st ourselves.

1. 1

   A page offers a free mod or client

   The lure is a free mod, a cheat client or a pack for a popular server. Check Point Research (June 2025) describes fake Minecraft mods spread through GitHub repositories that posed as cheat tools, run by a service it calls the Stargazers Ghost Network. The page here advertises free mods for a named server, which fits the same kind of lure.

2. 2

   You put the .jar into the mods folder

   That is what every mod guide tells you to do, so it does not feel risky. On Windows the usual place is the mods folder inside .minecraft under your AppData folder. A malicious file looks just like a good one, and the name can be copied from a real mod.

3. 3

   Starting the game runs the hidden code

   G Data (March 2026) describes a case where a real AppleSkin mod file was altered: the attacker added a hook into the mod's normal start routine, so the malware runs when Fabric starts the mod, while the mod still works. That is why nothing looks wrong. We note that appleskin-26.2.jar is among the 30 file names, but we do not know that its content matches that case.

4. 4

   A downloader brings the next stage

   Check Point describes a Java downloader, a second stage in Java that steals launcher and chat tokens, and a final stage written in .NET that steals browser credentials, crypto wallets and VPN profiles. The Java stages only run where Minecraft is installed, which helps them slip past automatic analysis. Whether the donutclients.st files use more than one stage is not known.

5. 5

   The stolen data is sent away

   The stealer packs what it found and sends it to a server of its owner. The owner then uses the logins, or sells them. You may see nothing at all on screen.

This is not new. In June 2023 the fractureiser investigation team described a virus found in several mods uploaded to CurseForge and BukkitDev, some of which were added to popular modpacks, and said it targeted Windows and Linux. The team's page says its event has ended, with no further activity found in the three months before, and also warns that a copycat is possible. A mod folder has been a target for years.

What a Minecraft mod stealer can take from a Windows PC

We do not know what these 30 files take. The list below is what researchers found in comparable Minecraft stealers. Treat it as the set of things worth changing after an infection, not as a statement about this site.

What this can cost you

Seeing the name of the site or visiting its home page is not what the risks below are about. They apply to a PC where one of the .jar files was put into the mods folder and the game was started.

• High

  Passwords and accounts

  If the file is a stealer, the logins saved in your browsers can be read. Email comes first, because it resets everything else. Changing a password on the infected PC does not help while the file is still there.

• High

  Discord, Telegram and launcher sessions

  A stolen token lets a stranger use your account without a password and often without a code. Researchers name these tokens as targets. Servers you moderate and friends you message are at risk too.

• High

  Crypto

  Wallet data is a named target in comparable stealers. Crypto sent from a stolen wallet cannot be reversed.

• Medium

  Your Minecraft account and server standing

  Someone logging in as you can get you banned on a server, spend your in game money or steal items. For a name tied to a popular server this is a real loss, even if it is not a bank loss.

• Medium

  More malware later

  A downloader stage can bring other programs. The first file is often only the door.

• Low

  Nothing, if you only saw the name

  A name in a log, a block list or a search result is not an infection.

What you may notice, and what you may not

Stealers are built to be quiet. The signs below are possible, none is certain, and many victims notice nothing until an account is used by someone else.

Who can meet these files, and how

The people who meet this are players who look for free mods, cheat clients or packs for a server such as the one named in the site's title. Searchers and ad clicks bring them to a download page that looks like a normal mod site.

1. 1

   You downloaded a mod or client from the site

   This is the case that matters. If a file named like Sodium-26.2.jar or meteor-client-26.2.jar came from this address, you hold a file that URLhaus tags as a stealer. Do not start the game with it.

2. 2

   A friend or a video sent you the link

   Check Point describes the Minecraft cheat scene as one where malware is passed through repositories and sharing. A link from a friend whose account was already stolen is a common route; we have no data that this happened here.

3. 3

   You only visited the page

   Visiting a page and not downloading anything is much lower risk. The danger starts when a file is saved and run. Close the tab and, to be safe, clear the downloads folder of anything you did not mean to keep.

4. 4

   You run a server, a modpack or a mod page of your own

   If you saw donutclients.st in your own files or links, check where it came from. A hacked page, a changed download link or a pack that pulled a file from here would spread it. Replace the link with the mod's official page and change the passwords of your site and host.

Check your PC before you delete anything

The question that matters is whether a .jar from this site ever ran on your PC. If you downloaded one but never started Minecraft with it, you have a file to delete and a lower risk. If you started the game with it in the mods folder, do all the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and do the account changes from another device.

1. 1

   Find the file

   Open File Explorer, type %appdata%\.minecraft\mods in the address bar and press Enter. Sort by Date modified. Look for any .jar you did not install yourself, and open your Downloads folder for files ending in -26.2.jar. Launchers such as Prism, CurseForge or Modrinth may use their own folders; look at the instance folder shown in the launcher. Do not delete yet. Write down the names.

2. 2

   Disconnect if you started the game with it

   Turn off Wi-Fi or unplug the cable. A stealer needs the connection to send data.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time you first started the game with the mod.

4. 4

   Look at Task Manager

   Open Task Manager and look at the Processes tab for programs you do not know, or a javaw.exe that keeps running after you closed the game. javaw.exe is the normal Java runtime for Minecraft, so it alone proves nothing, but one that stays alive with the game closed is worth a look.

5. 5

   Look at the Startup apps

   Open Settings > Apps > Startup and look for names you did not install. We do not know if these files add anything here, so a clean list does not clear the PC.

6. 6

   Check your accounts from another device

   Look at the sign in activity of your email, Discord, Microsoft or Minecraft account, your bank and any exchange. Look for devices and places you do not know. This is quicker and more telling than any file check.

7. 7

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Java stealers are often new, so a clean scan is one data point, the same as a clean site test. We did not infect a PC, so the order of the plan is our judgement from Microsoft's page and the researchers' reports, not a tested result.

If you use a Mac, Linux, an iPhone or an Android phone

Java mods are not tied to Windows, so the answer is different from a pure Windows trojan. Nothing we read says what these 30 files do on other systems.