donutsmpcheats.org: fake Minecraft cheat mods with the SilentNet stealer, and what to do if you installed one

What donutsmpcheats.org is, and what we know about it

donutsmpcheats.org is a website that offered Minecraft cheat mods as .jar files. On 30 September 2026 the URLhaus project of abuse.ch listed seven of those files as malware, tagged stealer and SilentNet. The site's own name points at DonutSMP, the name of a public Minecraft server; we found nothing linking that server's team to this site. This page sets out what the reports show, what researchers publish about fake Minecraft mods, and what to do if you ran one.

1. 1

   What URLhaus lists

   Seven file addresses in a folder called mods: liquidbounce-1.21.x.jar, wurst-7.54-mc1.21.11.jar, krypton-client.jar, meteor-client-1.21.11.jar, glazed-addon-1.21.11.jar, doomsday-client-1.21.11.jar and fakepay-1.21.x.jar. All were added within four seconds on 30 September 2026 by the reporter GhostTypes, all carry the label malware_download, and all were offline on 8 October 2026.

2. 2

   What the tags mean

   jar is the Java file type that Minecraft Java Edition mods use. minecraft says the files target the game. stealer says the code takes data from the computer it runs on. SilentNet is the name of the malware family the reporter matched.

3. 3

   What the file names copy

   The names copy cheat clients and addons that players search for, with version numbers like 1.21.11 that match current Minecraft releases. A player looking for an advantage on a server is the target. The original projects are not the danger here; the files on this site were.

4. 4

   What this means for you

   If you only opened the site and downloaded nothing, a mod file cannot run by itself. The risk is for a player who put one of these .jar files into the Minecraft mods folder and started the game. Then the code ran with the same access as Minecraft: your files, your browser data and your saved logins.

Kind of threat

A site that handed out fake Minecraft cheat mods; URLhaus tags all seven files stealer and SilentNet

Where the files were

hxxps://donutsmpcheats[.]org/mods/ followed by the .jar file name

Domain registered

12 September 2026, registrar NameCheap, Inc., status client transfer prohibited (RDAP, read 8 October 2026)

URLhaus entries

7 file addresses, all added 30 September 2026 at 04:39 UTC by GhostTypes; all 7 offline on 8 October 2026

Our request

8 October 2026: the name did not resolve in DNS (ENOTFOUND), so there was no server to ask

Platform

Any computer that runs Minecraft Java Edition with mods. The extra stages researchers found in similar campaigns were Windows programs

What we checked on 8 October 2026, and what we could not

We sent one plain request to donutsmpcheats.org from our server on 8 October 2026: no browser, no clicks, no downloads. It failed before it started, because the name no longer resolved in DNS. That means the site is unreachable today. It does not clear the site and it does nothing for a PC where one of the mods already ran.

What happened to donutsmpcheats.org, from registration to our check

The whole story fits into four weeks. Dates come from RDAP and from the URLhaus data we hold; times are UTC.

1. 12 September 2026

   The domain is registered

   RDAP shows donutsmpcheats.org registered on 12 September 2026 at 17:23 UTC through NameCheap, Inc., with the status client transfer prohibited, a common default lock.

2. 30 September 2026

   Seven fake mods are reported

   At 04:39 UTC the reporter GhostTypes adds seven .jar files from the mods folder to URLhaus within four seconds, all tagged jar, minecraft, SilentNet and stealer. The site had been up for less than three weeks.

   

3. 8 October 2026

   All files offline, and our check

   All seven entries are marked offline, and our plain request finds that the name no longer resolves in DNS.

What the pattern suggests, and what it does not: a new domain, a name built around one popular server, and many well known cheat names in one folder look like a site made only to spread these files. That is our reading of the dates and names, not something the report says.

How a fake Minecraft mod gets onto a PC

Nobody is infected by looking at a cheat site. The player downloads the .jar, puts it in the mods folder and starts the game; from then on it runs as part of Minecraft. We did not see these files run; this is how Check Point Research describes a campaign of the same kind.

1. 1

   The lure is a cheat

   Check Point (18 June 2025) found fake mods posing as cheat tools such as Oringo and Taunahi, spread through GitHub pages that looked popular because many accounts had starred them. donutsmpcheats.org used the names of other cheat clients, but the idea is the same.

2. 2

   The player installs it by hand

   Check Point notes that victims had to download the .jar and copy it into the Minecraft mods folder themselves. No exploit is needed; the player's own trust does the work.

3. 3

   The mod checks where it is

   In Check Point's case the Java code first looked for signs of a virtual machine or of network analysis tools and quit if it found any. That is one reason Check Point says the downloader was detected by no antivirus engine on VirusTotal at the time.

4. 4

   It fetches more code

   The first stage downloaded a second Java stealer into memory, which then pulled a third stage written in .NET for Windows. Each stage takes a different kind of data.

5. 5

   SilentNet itself

   For the family named in these reports, the sandbox service Triage describes a file called Krypton_Client.jar, the same name as one of this site's files, as a Minecraft SilentNet RAT, a Fabric mod stealer with blockchain C2. Fabric is a common Minecraft mod loader; blockchain C2 means it reads its instructions or server address from a public blockchain, which is hard to take down.

We found no vendor report that analyses SilentNet in depth. The family name, the RAT label and the blockchain detail come from sandbox tags, so treat them as strong indicators rather than a full analysis.

What a fake Minecraft mod can take

We did not run the files from donutsmpcheats.org, so this list comes from Check Point's analysis of a similar campaign and from the stealer and RAT labels on SilentNet. Not every build takes everything.

What this can cost you

Visiting the site or seeing its name costs nothing. The risks below apply to a computer where one of these mods was started with Minecraft.

• High

  Your Minecraft and Microsoft account

  A session token lets someone use your account without the password. Accounts are sold or used to cheat and spam on servers, and a ban for that can land on you.

• High

  Your Discord account

  A stolen Discord token is used to message your friends with the same kind of fake mod or a scam link, which spreads the infection.

• High

  Browser logins and email

  Saved passwords in the browser can open email, shops and school or work accounts. Email is the key to resetting everything else.

• High

  Crypto and game items

  Wallets and Steam items can be emptied. Crypto transfers cannot be reversed.

• Medium

  Someone controlling the PC

  The RAT label means remote control may be possible. That is why a reset is the safe answer if you cannot confirm the PC is clean.

• Low

  Nothing, if you only saw the site

  A downloaded .jar that was never put into Minecraft or opened with Java did not run.

What you may notice, and what you may not

Stealers are built to be fast and quiet: they take what they want in seconds. The signs below are what usually follows; most players notice the stolen accounts before anything on the PC.

How players end up on a site like this

A site like donutsmpcheats.org needs players to come to it. We do not know how this one was advertised; the routes below are the ones researchers describe for fake mods.

1. 1

   Search results for cheats

   A player searches for a cheat client for a server and a new site with the server's name in its address looks made for exactly that.

2. 2

   Links in Discord, YouTube or comments

   Videos and chats showing a cheat often link to a download. A stolen Discord account sending the link to its friends is a common way the next victims arrive.

3. 3

   Pages that look popular

   Check Point describes GitHub pages made to look trusted with stars from fake accounts. Popularity on a page is not proof that a file is safe.

Check your PC before you delete anything

Start with one question: did you put any .jar from donutsmpcheats.org into Minecraft and start the game? If you are sure you did not, delete the download and you are done. If you did, or you are not sure, assume your logins were taken and do the checks below. They do not delete anything.

Make your account changes from another device, such as your phone, not from the PC that ran the mod.

1. 1

   Look in the mods folder

   On Windows, press Windows + R, type %appdata%\.minecraft\mods and press Enter. If you use a launcher such as Prism, CurseForge or Modrinth, open the mods folder of each instance from the launcher. Look for the names on this page and for any .jar you did not get from the mod's official page. Write down what you find.

2. 2

   Check other launchers and instances

   Check Point found stealers that read files of the Feather, Essential and Lunar launchers. If you use those, check their mod folders too.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for any detection around the day you added the mod.

4. 4

   Look at what starts with Windows

   Open Settings > Apps > Startup and look for names you do not know. A stealer that also works as a RAT needs a way to start again.

5. 5

   Look at running programs

   Open Task Manager and look for java.exe or javaw.exe running when Minecraft is closed, or any unknown process with network use. Right click and choose Open file location to see where it lives.

6. 6

   Check your accounts from your phone

   Look at recent sign ins for your Microsoft account, Discord and email. This shows quickly whether the stolen data is already being used.

If you play on a Mac, a console or a phone

A .jar mod runs wherever Minecraft Java Edition runs, so a Mac or Linux PC with these mods is not automatically safe. The later stages researchers found in similar campaigns were Windows programs.