donutsmpclient.com: fake Minecraft client .jar files tagged SilentNet, and what to do if you ran one on Windows
donutsmpclient.com is a web page that offers a free Minecraft 1.21.11 client, and URLhaus lists eight of its .jar files (GoobaClient, FakeClientV3, FrostClientV2, WaterClientV6) as malware tagged SilentNet, six of them still online when we read the data.
A .jar file you put into Minecraft runs as code on your PC, so if you downloaded and started one of these files, treat your Minecraft and Microsoft accounts and the PC as exposed: change passwords from another device, then scan and clean or reset Windows. If you only saw the name or opened the page, nothing is proven against you.
Facts checked October 12, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like a Minecraft client .jar file downloaded from donutsmpclient.com usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove donutsmpclient.com (fake Minecraft client .jar files, SilentNet) yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Donutsmpclient.com (fake Minecraft client .jar files, SilentNet): summary
| Type | A malware download page: eight Minecraft client .jar files listed by URLhaus, all tagged SilentNet |
|---|---|
| Risk | High if you downloaded and ran one of the files: your Minecraft session, game and chat tokens and possibly browser data may be taken. Low if you only saw the name |
| Symptoms | Often none. A jar you did not install in the mods folder, a javaw.exe running with Minecraft closed, an unknown Defender exclusion or sign in alerts are the signs in the reports |
| How to get rid of it | Secure your accounts from another device, run Microsoft Defender Offline, remove the files and startup entries, and reset Windows if you are not sure |
| Our check (12 October 2026) | One plain request from our server: the home page answers (status 200) and offers a free client for Minecraft 1.21.11. It clears nothing; the rating comes from URLhaus |
| Running since / first seen | Domain registered 12 September 2026; first files reported 3 October 2026 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Platform | Minecraft Java Edition on a PC, mostly Windows. Nothing we read says phones are affected |
|---|---|
| Detection names | No Microsoft detection name is known for these files, because we did not open them. URLhaus and sandbox services use the tag SilentNet |
| Name | Donutsmpclient.com |
| Domain registered | 12 September 2026 |
| Evidence | 8 write-ups by security sites; details still limited |
| First seen | 3 October 2026 |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 12 October 2026 |
Facts checked on 12 October 2026 against the URLhaus data for donutsmpclient.com held in our database (we did not fetch the abuse.ch host page), RDAP, one plain request from our server, and the pages listed under sources.
We did not download the files and we infected no PC; the removal steps follow Microsoft's pages and were not tried on a live infection. Several details about SilentNet come from automated sample entries and are preliminary.
What donutsmpclient.com is, and what we know about it
donutsmpclient.com is not a program on your PC. It is a web address with a download page for a "free" Minecraft client, and the abuse.ch project URLhaus lists eight of its files as malware downloads. We found no vendor write-up of this one address, so what follows is what URLhaus shows, what our own plain request saw, and what published research says about fake Minecraft clients and the SilentNet tag.
- 1
What URLhaus lists
Eight file addresses, all ending in .jar and all in a folder path that starts with /__l5e/assets-v1/ followed by a long identifier. There are only four client names, GoobaClient, FakeClientV3, FrostClientV2 and WaterClientV6, each listed twice under different identifiers (WaterClientV6 once with the ending -1.21.11.jar and once without). All eight carry the threat label malware_download and the tag SilentNet. The reporter is a user named wok.
- 2
What is online
Six of the eight addresses were marked online and two (one GoobaClient and one FakeClientV3 from 3 October) were marked offline when we read the data. The four files added on 4 October were all online.
- 3
What the tag means
SilentNet is a label that researchers and sandbox services use for a family of malicious Minecraft mods. The sample summaries we could read describe Java mods for the Fabric mod loader that take the player's Minecraft session data, start themselves again as a hidden process and may download further code. We did not download your files or these ones, so we cannot say that every one of the eight does all of this.
- 4
What we do not know
We do not know who runs the site. The name contains DonutSMP, which is the name of a well known Minecraft server, but we found no statement from that server about this domain, and nothing proves the server is connected to it. Using a popular name for a fake download page is a common trick. We also do not know how people get sent to the page.
- Kind of threat
- A download page for fake Minecraft client .jar files; URLhaus tags every one SilentNet
- Where the files are
- hxxps://donutsmpclient[.]com/__l5e/assets-v1/<id>/<name>.jar, behind the Cloudflare network
- Domain registered
- 12 September 2026 through NameCheap, Inc.; status client transfer prohibited (RDAP, read 7 October 2026). The domain was 21 days old at the first report
- URLhaus entries
- 8 file addresses, added 3 October (4) and 4 October 2026 (4); 6 online, 2 offline
- File names
- GoobaClient-1.21.11.jar, FakeClientV3-1.21.11.jar, FrostClientV2-1.21.11.jar, WaterClientV6.jar and WaterClientV6-1.21.11.jar
- Platform
- Minecraft Java Edition on a PC. Most reports about this kind of malware are for Windows. A .jar runs wherever Java runs, but we found nothing about a Mac or Linux version of these files
What donutsmpclient.com (fake Minecraft client .jar files, SilentNet) does on an infected PC
What we checked on 12 October 2026, and what we could not
On 12 October 2026 our server made one plain request to the home page. It was not a browser visit: no clicks, no scripts run, no download. The page answered normally, and a quiet answer clears nothing.
Our check, 12 October 2026
- The page is live and offers a downloadThe request got status 200 from a server behind Cloudflare, with the page title "DonutSMP Client, Free Download for Minecraft 1.21.11". There was no redirect. That is a live page that offers a Minecraft client for download, nine days after the last URLhaus report.
- We did not run a browserA plain request does not run the page's scripts, so we cannot say what the download button does, whether it changes by country or device, or whether the page asks for anything else.
- Notification request, pop-ups, redirects, ad networksOur request found no sign of a notification API in the page text (it is not mentioned). That is not a test of pop-ups or of what happens after a click.
- URLhaus listingEight .jar files tagged SilentNet and malware_download; six online in our copy of the data.
- The files themselvesWe did not download any .jar and did not open it, so we cannot name what is inside or where it reports to.
Dangerous: do not download or run files from this address The rating comes from the eight URLhaus reports and what is published about the SilentNet tag, not from our request, which only shows that the page is up. A quiet request never clears a site.
What happened to donutsmpclient.com, from registration to our check
The domain is young. The first reports came three weeks after it was registered, in two bursts on consecutive days. Dates come from RDAP and the URLhaus data we hold; times are UTC.
12 September 2026
The domain is registered
RDAP shows donutsmpclient.com registered on 12 September 2026 at 05:06 UTC through NameCheap, Inc., with the status client transfer prohibited, a normal lock that stops an accidental transfer.
3 October 2026
Four files are reported
Between 17:29:14 and 17:29:22 UTC the reporter wok adds four addresses: a FakeClientV3 and a GoobaClient (both later marked offline), a FrostClientV2 and a WaterClientV6 (both online). All carry the tag SilentNet.
4 October 2026
Four more files, all online
At about 14:10 UTC the same reporter adds GoobaClient, FakeClientV3, FrostClientV2 and WaterClientV6 again, each under a new identifier, all online. The same four names under new identifiers within a day suggest the operator re-uploads the files; that is our reading of the dates, not something a report says.
7 October 2026
Registration data read
We read the RDAP record. It shows no change to the lock status.
12 October 2026
Our request
The home page answers with status 200 and a free download offer. Six of the eight reported addresses were online in the data we hold.
Registration on 12 September, four reports on 3 October, four on 4 October 2026. Drawn by us from RDAP and URLhaus data.
Why a "free client" .jar is a risk: how fake Minecraft clients work
A Minecraft client or mod is not a picture or a setting. It is a program, and Minecraft runs it with all your rights. That is why fake clients are a favourite way to deliver malware to players, and why the file itself is the danger.
- 1
The bait is a client with a popular name
Check Point Research (June 2025) described fake Minecraft cheat tools shared through GitHub repositories with a faked reputation. McAfee's reports on the WeedHack campaign, summarised by Security Affairs, describe fake client websites, YouTube videos with download links and search result poisoning. The bait is always something players want for free.
- 2
The download is a .jar
A .jar is a Java program in a zip container. Check Point found that the first two stages of its campaign were Java and ran only where Minecraft was installed, which also helps the files avoid sandboxes that have no game. The Java part then fetched a stealer written in .NET.
- 3
Minecraft starts it for you
When the file is placed in the mods folder of a Fabric profile, or run with Java, its entry point executes as soon as the game loads. The sample summary we read for a SilentNet file describes exactly this: a Fabric entry point takes the session username, ID and access token, then relaunches the jar as a hidden process.
- 4
More can follow
The same summaries describe downloading and running additional payloads, adding a Windows Defender exclusion folder and allocating memory in other processes. Some entries describe the address of the controlling server being stored in a blockchain contract, which makes it harder to shut down. These are sandbox results and tags for other SilentNet samples; we cannot say they hold for the eight files on this domain.
What this means for you: a client from a site like this needs no exploit and no bug. The game does the work once you press play. The only reliable defence is not to run files from places that are not the maker's own.
What donutsmpclient.com (fake Minecraft client .jar files, SilentNet) can steal or download
What a fake Minecraft client can take from a Windows PC
The list below is what the sources say this class of malware takes. No single report lists everything, and we do not know which items apply to the files on donutsmpclient.com.
Reported as possible
- Your Minecraft session (name, ID, access token)
- Discord tokens
- Telegram tokens
- Saved browser passwords
- Session cookies
- Cryptocurrency wallet data
- Files from your PC
- Extra malware downloaded
- A hidden process that keeps running
| Data | Detail | Source |
|---|---|---|
| Minecraft session | A SilentNet sample is described as taking the username, UUID and access token and relaunching itself hidden | MalwareBazaar sample entry |
| Game and chat tokens | The stealer in the Stargazers campaign targets Minecraft, Discord and Telegram tokens | Check Point Research |
| Browser data and wallets | WeedHack is described as stealing session cookies, passwords, browser data and crypto wallet contents | Security Affairs, citing McAfee |
| More malware | Check Point describes a Java downloader that fetches a third stage .NET stealer | Check Point Research |
What this can cost you
Opening the page or seeing the name costs nothing by itself. The risks below apply to a PC where one of the .jar files was downloaded and started.
- High
Your Microsoft and Minecraft account
A stolen session token lets someone use your Minecraft account without your password. Microsoft's answer forums describe hacked players whose owner then loses the account if the attacker changes the security info. Act first, from another device.
- High
Passwords and browser logins
If the file also holds a stealer, every password saved in the browser and every logged in session is at risk, not only the game. Email is the one to protect first because it resets the rest.
- High
Crypto and payments
Wallet data is named in the WeedHack and Stargazers reports. Money sent from a stolen wallet cannot be recalled.
- Medium
Discord and your friends
A stolen Discord token lets someone message your friends and servers as you, usually with the same fake client link. Players are often young, which attackers know.
- Medium
More malware on the same PC
A downloader can bring other families later, so a quick fix to the game folder may not be enough.
- Low
Nothing, if you only saw the name
A name in a block list, a log, a link in chat or an opened page is not an infection. The risk starts when a file is run.
What you may notice, and what you may not
Stealers are built to be quiet. The signs below come from the sources and from what they imply; none is certain, and many victims notice nothing until an account is taken.
| Sign | What the reports show |
|---|---|
| A new jar file in your mods folder | A fake client has to be placed there or run. Look in %appdata%\.minecraft\mods and in the folder of your launcher for names such as GoobaClient, FakeClientV3, FrostClientV2 or WaterClientV6 |
| A java or javaw process you did not start | A SilentNet sample is described as relaunching itself as a hidden javaw.exe process. A javaw.exe with Minecraft closed is worth a look |
| A Defender exclusion you did not add | Sandbox results for SilentNet samples report a folder exclusion being added to Windows Defender |
| Logins from new places | Email about a new sign in to Microsoft, Discord or a game account, or a changed username or skin. This follows from stolen tokens; it is our reading |
| Friends get links from you | A hijacked Discord account often spreads the same download |
| Nothing at all | Quiet running is the point of a stealer |
How to check the PC for donutsmpclient.com (fake Minecraft client .jar files, SilentNet)
How a person ends up on this page
Nobody finds donutsmpclient.com by accident while using Minecraft normally. People are sent to it. We cannot say how for this domain; the routes below are the ones vendors found for similar fake client sites.
- 1
A search for a free client
McAfee, as summarised by Security Affairs, describes search result poisoning around fake client sites. A search such as a server name plus "client download" can put a lookalike page on top.
- 2
A video or a chat link
The same report names YouTube videos whose description links to the download. A friend whose Discord was already taken may also send the link.
- 3
A code repository or forum post
Check Point describes repositories with invented stars that look trusted. A real project page is normally linked from the maker's own site; a stranger's mirror is not.
Check your PC before you delete anything
Start with one question: did you download or run a .jar from donutsmpclient.com, or any client from a site you do not know? If you only saw the name in a chat, a log or a warning, you are not infected by that alone. If you did run a file, or you are not sure, do the checks below. None of them deletes anything.
While you check, stop using the PC for banking, email and crypto, and disconnect it from the network if you can. Do the account changes on another device.
- 1
Close Minecraft and disconnect
Quit the game and the launcher. Turn off Wi-Fi or unplug the cable. A stealer or a downloader needs the connection to send data or fetch more.
- 2
Find the file you downloaded
Open File Explorer > Downloads and look for the names listed above. Do not double click them. Then open the mods folder of your launcher (the default for the Minecraft launcher is %appdata%\.minecraft\mods) and note any jar file you did not install yourself. Write the names down before you delete anything.
- 3
Look at running programs
Open Task Manager, Processes tab, with Minecraft closed. Look for javaw.exe or java.exe still running, or any process with a lot of network use. A SilentNet sample is described as hiding as a javaw.exe process. Its presence is not proof, and its absence does not clear the PC.
- 4
Check what starts with Windows
Open Settings > Apps > Startup and switch off nothing yet; just note entries you do not recognise. The sources say SilentNet samples persist in hidden ways, so also open Task Scheduler and look in Task Scheduler Library for tasks you did not make.
- 5
Open Protection history
In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time of the download. Results of an offline scan appear there too.
- 6
Check Defender exclusions
In Windows Security > Virus & threat protection > Manage settings > Exclusions, open Add or remove exclusions and look for folders you did not add. Sandbox results for SilentNet samples report an exclusion being added. A clean list does not clear the PC.
- 7
Check your accounts from another device
Look at the sign in activity of your Microsoft account, Discord, email and any exchange. This is quicker and more telling than any file check.
- 8
A scan helps but does not clear the PC
A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. We did not infect a PC with these files, so the order of the plan below is our judgement from Microsoft's pages, not a tested result.
How to remove donutsmpclient.com (fake Minecraft client .jar files, SilentNet)
How to remove donutsmpclient.com
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Programs like donutsmpclient.com add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after donutsmpclient.com, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of donutsmpclient.com that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Donutsmpclient.com can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
If you use a Mac, an iPhone or an Android phone
The files are Minecraft Java Edition mods. We found nothing that says they affect a phone, and nothing that confirms or rules out a Mac.
| Your device | What we know | What to do |
|---|---|---|
| Mac | A .jar runs wherever Java runs, but the sources we read describe Windows behaviour (Defender exclusions, javaw.exe). We could not confirm a Mac version | If you ran one of the files on a Mac, treat your accounts as exposed and change passwords from another device. Do not follow the Windows steps |
| iPhone or iPad | Minecraft Java mods do not run on iOS | Nothing to remove. If you typed a password on the page, change it |
| Android | Java Edition mods do not run on the Android version of Minecraft. A phone launcher is a different case we did not check | Nothing to remove for these files; do not install an .apk from the same site |
After removal: passwords, accounts and prevention
After you ran a file: protect what was taken, then clean the PC
The PC is one half. The other half is everything that was typed or stored on it. The order matters: another device first, then the PC.
- 1
Secure the Microsoft account from another device
Go to account.microsoft.com > Security, review the sign in activity, remove devices you do not know and change the password. Microsoft's community answers for hacked Minecraft players also point to the option to sign out everywhere under the sign in options, and to turning on two step verification, ideally with an authenticator app. These answers come from Microsoft's forums, not from a support article, so menu names may differ for your account.
- 2
If the account is already taken
The same answers say the Microsoft recovery form is the route when the attacker changed the security info, and that Minecraft Support (aka.ms/Minecraft-Support) may help with the game licence if the recovery fails, usually with proof of purchase. We did not test these routes.
- 3
Change Discord, email and other passwords
Change them from the clean device, email first, then Discord, bank, cloud storage and crypto. Log out other sessions where the service offers it and turn on two step sign in. A session token can survive a password change on some services, which is why signing out everywhere matters.
- 4
Move crypto first if a wallet was on the PC
If a seed phrase or wallet file was ever on the PC, assume it is known. Create a new wallet on a clean device and move the funds.
- 5
Run Microsoft Defender Offline
Microsoft says to open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: the PC restarts and the scan takes about 15 minutes. Results are under Protection history. Microsoft's support page says to use it when you suspect malware that your security software is not catching.
- 6
Remove what the check found, with care
Delete the jar files you tied to the download, remove unknown exclusions and unknown scheduled tasks, and uninstall unknown programs under Settings > Apps > Installed apps. If you cannot tell what is yours, do not guess.
- 7
If you are not sure, reset Windows
Open Settings > System > Recovery > Reset this PC. Keep my files removes apps and settings but keeps personal files; Remove everything wipes the PC. If a downloader may have run, the full wipe is the answer that does not depend on finding every piece. Back up documents first.
- 8
Restore only documents by hand
Copy back documents, screenshots and worlds you made, not programs and not mods. Download the launcher and any mods again from the makers' own sites.
- 9
Tell your friends
If your Discord or other accounts were used to send the link, tell your contacts not to open it, and report the account to the platform.
- 10
Watch the accounts for a few weeks
Keep checking sign in activity and bank statements, and set up alerts.
If this is your server or you run the real DonutSMP
A lookalike domain that borrows a server name is not the server's own site. We do not know who is behind donutsmpclient.com and make no claim about the server called DonutSMP.
- 1
Say clearly where downloads come from
Tell your players on your own site and chat which address is official and that you do not hand out client files from other domains. A short pinned notice is enough.
- 2
Report the lookalike
Report the domain to the registrar named in the RDAP record (NameCheap, Inc.) and to the network provider in front of it (Cloudflare), and report the URLs to abuse.ch URLhaus. We cannot promise any of them will act quickly.
- 3
If your own site hosts the files
If you believe a real site of yours is serving these files, a different case, remove the files, change every password and key on the host, update the software and look for the entry route before you restore anything.
Keep a PC out of this kind of chain
The bait changes every month. The habits that stop it do not.
Do
- Get Minecraft, the launcher and mods only from Minecraft.net, the launcher itself or well known mod sites that you reach from the maker's own page.
- Ask the server staff, on the server's own site, which client or mod list it allows.
- Keep Windows and Microsoft Defender updated; the offline scan uses the latest definitions.
- Use a different password for every account and turn on two step sign in with an authenticator app.
- Show file endings in File Explorer so a .jar or .exe is easy to see.
- Tell younger players in your family that a free client is a program that can take their account.
Don't
- Do not download a client from a link in a video description, a chat message or a search result you do not know.
- Do not run a jar file just because the name matches a server you like.
- Do not switch off Defender or add a folder exclusion because a download tells you to.
- Do not change passwords on the PC you suspect.
- Do not rely on a quiet scan or a quiet web page to say that you are safe.
Questions about donutsmpclient.com (fake Minecraft client .jar files, SilentNet)
What is donutsmpclient.com?
It is a web address with a page that offers a free Minecraft 1.21.11 client. URLhaus, the malware tracking project run by abuse.ch, lists eight .jar files on it as malware downloads, all tagged SilentNet, added on 3 and 4 October 2026.
The domain was registered on 12 September 2026. It is not a program on your PC. We did not download the files, so what they contain is not confirmed by us, and we found no proof that the Minecraft server called DonutSMP is connected to it.
Is donutsmpclient.com safe?
No. Do not download or run files from it. Our plain request on 12 October 2026 found a live page with a download offer, which proves nothing about safety: a request without a browser does not run the page's scripts or show what the button gives you.
The rating comes from eight URLhaus reports for .jar files, six of them online when we read the data. Opening the page alone is unlikely to harm you; running a file from it is the risk.
Is the DonutSMP Client a virus?
Files with that kind of name from this address are listed as malware by URLhaus, and a Minecraft client is a program that runs with your rights, so treat them as malware. We could not confirm what each file does, because we did not open them.
Vendors describe SilentNet samples as Fabric mods that take the Minecraft session and may fetch more code. If you want a client for a server, take it only from that server's own official site.
What does SilentNet mean?
SilentNet is a tag that researchers and sandbox services give to a group of malicious Minecraft mod files. The sample entries we read describe Java mods that take the player's session username, ID and access token, relaunch as a hidden javaw.exe process, add a Windows Defender exclusion and may download further payloads.
Some entries mention a controller address stored in a blockchain contract. These details come from automated entries and are preliminary, so they may not hold for every file.
I downloaded a client from this site. What should I do?
If you did not run it, delete it and empty the recycle bin. If you did run it, close Minecraft, disconnect the PC and use another device to secure your Microsoft account:
- review sign in activity
- change the password
- sign out everywhere
- turn on two step verification
Then change Discord, email and other passwords, run a Microsoft Defender Offline scan on the PC, and reset Windows if you are not sure the PC is clean.
How do I remove it from Windows?
Delete the jar files you downloaded and any unknown jar in your mods folder, run a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options), and check Task Scheduler, Startup apps and Defender exclusions for entries you did not make.
If you cannot tell what is yours, reset Windows with Remove everything and restore only documents. We followed Microsoft's pages for this and did not test the steps on an infected PC.
Can someone take my Minecraft account with this?
Yes, if a session token was taken. A SilentNet sample is described as taking the username, UUID and access token, which can let someone use the session without your password.
Microsoft's community answers for hacked players say to review the account's sign in activity, change the password, sign out everywhere, turn on two step verification and contact Minecraft Support if the attacker changed the security info. Do this from another device, not the infected PC.
Does it affect Mac, iPhone or Android?
We found nothing that says it does on a phone, because Minecraft Java mods do not run on iOS or in the Android edition.
A .jar can run on a Mac wherever Java is installed, but the behaviour described in the sources is Windows specific, such as a Defender exclusion and a javaw.exe process, and we could not confirm a Mac version. If you ran a file on a Mac, change your passwords from another device.
I saw the name in a link a friend sent me. Am I infected?
Not by that alone. Seeing a link or opening the page does not run a file. A friend who sends such a link may have had their Discord account taken, so tell them, and do not download the client.
If you did download and start it, follow the checks and the account steps on this page. If you did not, no cleaning is needed, but it is wise to use two step sign in and to keep Windows and Defender updated.
Will Fortect remove donutsmpclient.com?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For donutsmpclient.com, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- MalwareBazaar (abuse.ch): sample entry tagged SilentNet, a trojanized Minecraft client (read October 12, 2026)
- Check Point Research: Minecraft mod malware, Stargazers Ghost Network (June 2025) (read October 12, 2026)
- Security Affairs: Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown (McAfee research) (read October 12, 2026)
- Microsoft Learn: Microsoft Defender Offline scan (read October 12, 2026)
- Microsoft Q&A: How to recover hacked Minecraft account (community answers, not an official article) (read October 12, 2026)