donutsmpclientts.lovable.app: a free Minecraft client site whose nine .jar files are tagged zero stealer, and what to do on Windows if you ran one
donutsmpclientts.lovable.app is a web page offering free Fabric Minecraft clients, and URLhaus lists nine of its .jar downloads (radium, krypton, corz, gooba, dqrkis, zyron, fakepay, frost and xenon) as malware tagged zero stealer.
A .jar from that page is a program, so if you only saw the name nothing is proven, but if you downloaded and ran one, treat your passwords and game accounts as exposed, change them from another device, then scan and clean Windows.
Facts checked October 17, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like a .jar file downloaded from donutsmpclientts.lovable.app usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove donutsmpclientts.lovable.app (zero stealer, .jar files) yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Donutsmpclientts.lovable.app (zero stealer, .jar files): summary
| Type | A malware download page: URLhaus lists nine .jar files from it as malware tagged zero stealer |
|---|---|
| Risk | High if you ran one of the files: logins, tokens and game accounts may be taken. Low if you only saw the name |
| Symptoms | Often none. Sign in alerts, Discord messages you did not send and unknown .jar files in the mods folder are the signs to check |
| How to get rid of it | Change passwords from another device, run Microsoft Defender Offline, delete the file and check startup, and reset Windows if you are not sure |
| Our check (17 October 2026) | One plain request from our server: the home page answered, no redirect. The nine file addresses are marked offline. A quiet answer clears nothing |
| Running since / first seen | Files first reported 15 October 2026; the parent domain lovable.app dates from 6 May 2023 and says nothing about this page |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Platform | Java files: can run on Windows, Mac and Linux. Windows steps in this guide |
|---|---|
| Detection names | No Microsoft detection name is known for these files, because we did not open them |
| Name | Donutsmpclientts.lovable.app |
| Domain registered | 6 May 2023 |
| Evidence | 9 write-ups by security sites; details still limited |
| First seen | 15 October 2026 |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 17 October 2026 |
Facts checked on 17 October 2026 against the URLhaus rows for this host held in our database (we did not open the abuse.ch page itself), RDAP for lovable.app, one plain request from our server, and published pages by Microsoft, the FTC, Security Affairs and public tria.ge sandbox reports.
We did not download the files and we infected no PC; the removal steps follow Microsoft and FTC pages and were not tried on a live infection.
What donutsmpclientts.lovable.app is, and what we know about it
donutsmpclientts.lovable.app is not a program on your PC. It is a web address, a project page on the lovable.app hosting domain, that the abuse.ch project URLhaus lists as a place that served malware. We found no public write up of this one address, so what follows is what URLhaus shows, what our server saw, and what researchers have published about Minecraft mods that steal data.
- 1
What URLhaus lists
Nine file addresses, all in the folder /api/public/download/ on this host: radium.jar, krypton.jar, corz.jar, gooba.jar, dqrkis.jar, zyron.jar, fakepay.jar, frost.jar and xenon.jar. All nine were added on 15 October 2026 at 00:54:07 UTC by one reporter, who goes by wok. Each carries the threat label malware_download and the tag zero stealer.
- 2
What the tag means
zero stealer is the name the reporter gave the malware. A stealer is a program that collects logins, session tokens and files from the PC it runs on and sends them to its operator. We found no vendor write up under the name Zero Stealer, so we cannot tell you what exactly this one takes. We did not download the files.
- 3
What the page looks like from outside
On 17 October 2026 our server made one plain request to the address. The answer was a normal page (status 200) with the title Donut Clients, Free Fabric Minecraft Clients, served through Cloudflare. A Minecraft client in this sense is a modified game program, often a cheat or utility pack, and Fabric is a common way to load such mods. The name suggests it targets players of a Minecraft server with a similar name; that is our reading, not a fact from a report.
- 4
What this means for you
If you saw the name in a browser warning, a blocked request or a log, you are not infected by that alone. The risk is for a person who downloaded one of the nine files and ran it, or put it in the Minecraft mods folder and started the game. A .jar file is a program, not a picture or a texture.
- Kind of threat
- Java programs (.jar files) offered as free Minecraft clients, listed by URLhaus as malware and tagged zero stealer
- Where the files were
- hxxps://donutsmpclientts[.]lovable[.]app/api/public/download/NAME.jar, nine names, all reported on 15 October 2026
- Current state
- All nine addresses were marked offline in the data we hold on 17 October 2026. The home page still answered our request
- Domain registration
- The registration record is for lovable.app, the shared parent domain: created 6 May 2023, registrar CloudFlare, Inc. (RDAP, read 15 October 2026). It says nothing about who runs this one page
- Platform
- Java programs can run on Windows, Mac and Linux. This guide is written for Windows, where most Minecraft players are; see the section on other devices
- Detection names
- No Microsoft detection name is known for these files, because we did not open them
What donutsmpclientts.lovable.app (zero stealer, .jar files) does on an infected PC
What we checked on 17 October 2026, and what we could not
Our check was a single plain request from our server to https://donutsmpclientts.lovable.app/. It used no browser, no clicks and no download. That clears nothing: a page can show different things by country, device, referrer or after a click.
Our check, 17 October 2026
- The home page answersStatus 200, no redirect, title Donut Clients, Free Fabric Minecraft Clients, server header cloudflare. The page is still up while the nine file addresses are marked offline.
- Why a working page is not a clean resultThe reports are about the download paths, not the home page. A page that looks like an ordinary download list is exactly what a lure looks like.
- Notification requestNot mentioned in the page code we received. This is one plain request, so it tells you nothing about later visits or a real browser.
- URLhaus listingNine .jar files, all tagged zero stealer, all labelled malware_download, all added on 15 October 2026. All marked offline when we read our copy.
- Downloads and the files themselvesWe did not download any file and did not run one. We cannot tell you what is inside them or where they send data.
Dangerous: treat the downloads as malware The rating comes from the nine URLhaus reports, not from our visit. Our visit was one plain request and proves nothing either way. Do not download or run a .jar from this address.
What happened, from the shared domain to our check
The history of this one page is short and mostly unknown. The dates come from RDAP for the parent domain and from the URLhaus rows we hold; times are UTC.
6 May 2023
lovable.app is registered
RDAP shows the parent domain lovable.app created on 6 May 2023 through CloudFlare, Inc., with the status client transfer prohibited. This is the shared domain that many different projects use as a subdomain, so it tells you nothing about this page's age.
Before 15 October 2026
The page and the files exist
We do not know when the page was created or when the files were first uploaded. The reports are the earliest evidence we hold.
15 October 2026
Nine .jar files are reported in one batch
At 00:54:07 UTC, URLhaus rows for radium, krypton, corz, gooba, dqrkis, zyron, fakepay, frost and xenon .jar are added, all with the tag zero stealer. One identical time stamp for nine files means one person or script reported them together.
The nine URLhaus entries for this host. The folder and the tag are the same; only the file names change. 17 October 2026
Our check
The home page answers with status 200. The nine file addresses are marked offline in our data. We record this as the state on that day, nothing more.
What the pattern suggests, and what it does not: nine different names such as radium and xenon fit a page that offers a list of separate clients to choose from. Each file may be a different build of the same payload, or nine different ones. That is our reading; no report says which.
How a free Minecraft client can steal from a PC
A Minecraft mod is not a picture or a setting. It is Java code that runs inside the game with the same rights as you. If that code is a stealer it can read what your user account can read. We did not open these files; this is how published reports describe the same kind of campaign.
- 1
A lure for players
Security Affairs describes a campaign it attributes to the Stargazers group, in which malicious Minecraft mods were offered to gamers through fake plugin downloads. Free clients, cheats and performance mods are the kind of bait that works, because players expect to download unsigned files from pages and chats.
- 2
A Java loader and a second stage
In that report a fake Forge plugin starts a chain: a Java loader downloads a second Java stealer that extracts Minecraft and Discord data, and a .NET stealer then goes after browser credentials and crypto wallets. We do not know whether the zero stealer files follow this chain.
- 3
Automated analysis of similar mods
Public sandbox reports on tria.ge classify a group of Fabric mod .jar files as the WeedHack RAT family and describe a mod that steals session tokens, downloads and runs more payloads and persists. Those reports do not use the name zero stealer, so we do not claim the two are the same.
- 4
It runs with the game
A Fabric mod loads when the game starts. The code then has the file rights of your Windows account: your browser profile folders, the Minecraft launcher folder and documents. No administrator prompt is needed to read those.
A quiet game does not mean a clean mod. The cheat or client may really work, which is why players have little reason to suspect it. Every point in this section comes from other incidents; for the nine files on this page the contents are not confirmed.
What donutsmpclientts.lovable.app (zero stealer, .jar files) can steal or download
What a stealer like this can take
We cannot say what these nine files take. The list below is what the stealer reports we read describe for Minecraft related stealers in general. Treat it as the worst case to plan for, not as a finding about this page.
Reported as possible for this kind of stealer
- Minecraft and Microsoft account session tokens
- Discord data
- Saved browser passwords and cookies
- Cryptocurrency wallet data
- Telegram data
- Files from your user folders
- Extra malware downloaded later
| Data | What the reports say | Source |
|---|---|---|
| Minecraft and Discord data | The second stage Java stealer in the Stargazers chain extracts Minecraft and Discord data | Security Affairs |
| Browser logins and wallets | A .NET stealer in the same chain goes after browser credentials and crypto wallets | Security Affairs |
| Session tokens and more payloads | Sandbox reports for similar Fabric mods describe stolen session tokens, extra payloads and persistence | tria.ge sandbox reports |
| This page's files | Not known. The reporter's tag is zero stealer; nothing more is public | URLhaus data in our database |
What this can cost you
Seeing the name or reading the page costs nothing we know of. The risks below apply to a PC where one of the files was run.
- High
Account takeover
A stolen session token or password lets someone sign in as you at Microsoft, Discord or a game server without your help. Changing passwords on the same PC does not help while the stealer is still there.
- High
Crypto and payments
If a wallet file or a seed phrase was on the PC, assume it is known. Crypto sent from a stolen wallet cannot be reversed.
- Medium
Your game items and server accounts
Accounts on Minecraft servers can be sold or emptied. Server owners often cannot restore lost items.
- Medium
More malware on the same PC
The chains described by researchers download further stages. A first file can be the door for others.
- Medium
Friends and servers you chat with
A stolen Discord account is used to send the same bait to your contacts, which is how such pages find new players.
- Low
Nothing, if you only saw the name
A name in a warning, a log or a block list is not an infection.
What you may notice, and what you may not
Stealers are built to be quiet. The signs below follow from what such programs do; none is certain, and many victims notice nothing until an account is used.
| Sign | What it means |
|---|---|
| Sign in alerts you did not cause | Mails from Microsoft, Discord or a game service about a new location or a changed password follow from stolen tokens or logins. This is our reading, not a quote |
| Messages sent from your Discord account | Links to the same kind of free client, sent to your friends, are a typical result of a stolen account |
| A .jar in the mods folder you do not remember | Check the folder .minecraft\mods in your user profile for names such as radium, xenon or frost that you did not install on purpose |
| A Defender detection on a .jar or on a Java process | Look in Protection history for a detection at the time you first ran the file |
| A new program that starts with Windows | Reports on similar mods mention persistence; check Startup apps |
| Nothing at all | Quiet running is the point of a stealer |
How to check the PC for donutsmpclientts.lovable.app (zero stealer, .jar files)
How someone ends up with one of these files
Nobody needs this page to play Minecraft. A person ends up here by following a link, so the real question is where the link came from. We do not know how this page was promoted; the routes below are the ones researchers found for similar campaigns.
- 1
A link in a chat, video or forum post
The Stargazers report and the MaksStealer write up by Gridinsoft describe mods spread through gaming forums, comments and Discord servers. A message such as try this free client, it is undetected is the typical form.
- 2
A search for a free client or cheat
Pages on free app hosts rank for game related searches because they cost nothing to create. A download list with names like radium or xenon looks like a normal mod site.
- 3
A file that looks like a mod
The file ends in .jar like every real mod. You cannot tell by the name or the size whether it is safe. Only a scan, a trusted source and the author's reputation help.
Check your PC before you delete anything
Start with one question: did you download or run a .jar from this address, or from a link in a chat that led to it? If you only saw the name in a warning, you can stop here. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.
- 1
Close Minecraft and disconnect
Quit the game and the launcher. Turn off Wi-Fi or unplug the network cable until you have changed your passwords from another device. A stealer needs the connection to send data out.
- 2
Find the file
Open File Explorer, then Downloads, and look for the file names listed on this page. Then open the Minecraft folder by pressing Windows + R, typing %appdata%\.minecraft and pressing Enter, and look inside mods for files you do not remember adding. Write the names down; do not run them.
- 3
Look at running programs
Open Task Manager with Ctrl + Shift + Esc. On the Processes tab look for java.exe or javaw.exe while Minecraft is closed, and for names you do not know. A Java process with no game open is worth a closer look. Its presence is not proof and its absence clears nothing.
- 4
Check what starts with Windows
Open Settings > Apps > Startup and look for names you did not install. Switch off what you do not recognise. We did not find a source that says these exact files add a startup entry, so a clean list does not clear the PC.
- 5
Open Protection history
In Windows Security > Virus & threat protection > Protection history, look for a detection on a .jar file, a Java process or anything blocked or quarantined around the time you ran the file. Microsoft says the results of an offline scan also appear there.
- 6
Check your accounts from another device
Look at the sign in activity of your Microsoft account, Discord, email and any exchange. This is quicker than any file check, and it shows whether a token was used.
- 7
A scan helps, but it does not clear the PC
A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. Nobody publishes a removal procedure for these nine files and we infected no PC, so the order of the plan is our judgement from Microsoft and FTC pages, not a tested result.
How to remove donutsmpclientts.lovable.app (zero stealer, .jar files)
How to remove donutsmpclientts.lovable.app
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to donutsmpclientts.lovable.app or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever donutsmpclientts.lovable.app installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
If you use a Mac, Linux, an iPhone or an Android phone
A .jar file is a Java program, and Java runs on more than Windows. Nothing we read says what these nine files do on other systems, so the safe answer is to treat them the same way.
| Your device | What we know | What to do |
|---|---|---|
| Mac or Linux | Minecraft Java Edition runs there, so a .jar can run there. We do not know whether these files have code for those systems | If you ran one, change your passwords from another device and check the mods folder. The Windows menu paths on this page do not apply |
| iPhone or iPad | Minecraft mods of this kind are not installed on iOS. No source describes this threat there | Nothing to remove. If you typed a password on a suspicious page, change it |
| Android | No source mentions Android for these files | Nothing to remove for this threat; change passwords if you entered any |
After removal: passwords, accounts and prevention
After you ran one: protect what may have been taken
The PC is one half. The other half is everything you typed or stored on it. The order matters: another device first, then the PC.
- 1
Change passwords from a clean device
Use a phone or another PC that never ran the file. Start with your email, because it resets everything else, then Microsoft, Discord, your bank, work accounts and crypto. The FTC advises a unique password of about 12 to 15 characters or a passphrase of several words.
- 2
Sign out everywhere and turn on two factor sign in
The FTC says to sign out of the account on all devices so anyone else logged in is removed, and to turn on two factor authentication if it is offered. This matters here because a stolen session token can keep working after a password change on some services. Update the recovery email and phone while you are there.
- 3
Move crypto first if a wallet was on the PC
If a seed phrase or wallet file was ever on the PC, assume it is known. Create a new wallet with a new recovery phrase on a clean device and move the funds there.
- 4
Run Microsoft Defender Offline
Microsoft says to open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: Windows signs you out and restarts, and the scan takes about 15 minutes. Results are under Protection history. If BitLocker is on, Microsoft says to suspend it first or the restart may ask for the recovery key.
- 5
Delete the file and the mod, with care
Remove the downloaded .jar from Downloads and any file from the mods folder that you tied to this page. Empty the Recycle Bin. If you cannot tell which file is bad, do not guess: the safe answer is the reset below.
- 6
If you are not sure, reset Windows
Microsoft's recovery page offers Reset this PC in Settings or under Troubleshoot in the recovery environment. Keep my files removes apps and settings but keeps personal files; Remove everything removes personal files, apps and settings. For a PC that ran a stealer, the full wipe is the answer that does not depend on finding every piece. Back up first and keep your BitLocker recovery key.
- 7
Restore only documents by hand
Copy back documents and screenshots, not programs and not mods. Download Minecraft and the launcher again from the official sources.
- 8
Use a password manager
Do not let the browser save passwords again on a PC that was watched. A password manager and an authenticator app or security key make one stolen password less useful.
- 9
Watch your money and accounts
Check card statements and exchange logs for a few weeks. The FTC says to report stolen personal information at IdentityTheft.gov, which gives a recovery plan.
- 10
Tell the people you play and chat with
If your Discord or game account sent links, tell your contacts not to open them, and tell the server staff if your account was used there.
If this is your site or you manage a server
There are two kinds of readers who land here for another reason: someone who runs a Minecraft community, and someone who owns a project on a free app host. We know nothing about who made this page, so this is general advice, not an accusation.
- 1
Server staff
Warn members not to run clients from links in chat, and ask anyone who did to change their passwords from another device. Remove the link from channels and pin a notice.
- 2
Someone who finds their own page listed
If you built a project and did not upload these files, change the password and sign in methods of the account on the app host, remove files you do not know, and check who has access to the project. We cannot tell you whether this page was made on purpose.
- 3
Report a page like this
Use the report form of the host and of the browser warning service you use. The URLhaus rows exist because someone reported the files; more reports help get the page taken down.
Keep a PC out of this kind of chain
The weak point is the moment a player runs a file because a chat or page said it is free and undetected. Every researcher write up we read starts there.
Do
- Get mods from the well known mod sites and the authors' own pages, and check how long the author has been active.
- Keep Windows and Microsoft Defender updated; the offline scan uses the latest definitions.
- Show file endings in File Explorer so you know what you are opening.
- Use a password manager and two step sign in on Microsoft and Discord.
- Play on a separate Windows user account without saved browser logins.
- Keep a backup of your worlds and documents on a disk that you unplug.
Don't
- Do not run a .jar from a link in a chat, a comment or a free app host page.
- Do not trust the claim undetected or the number of downloads on a page.
- Do not use cheats or clients that ask you to turn off antivirus.
- Do not change your passwords on the PC you suspect.
- Do not rely on a quiet scan to say that you are safe.
Questions about donutsmpclientts.lovable.app (zero stealer, .jar files)
What is donutsmpclientts.lovable.app?
It is a web page on the lovable.app hosting domain that offers free Fabric Minecraft clients. URLhaus, the malware tracking project run by abuse.ch, lists nine .jar files from its download folder, all added on 15 October 2026 and all tagged zero stealer.
It is not a program on your PC. We did not download the files, so what they contain is not confirmed by us, and we found no public write up of this particular page.
Is donutsmpclientts.lovable.app safe to open?
Do not download or run anything from it. Our own check was one plain request from our server, and the home page answered normally, which clears nothing: the reports are about the download paths, and a lure page often looks ordinary.
The nine file addresses were marked offline when we read our data on 17 October 2026, but a page can put new files up again. The rating comes from the URLhaus reports.
What is zero stealer?
It is the tag the reporter gave the nine files on URLhaus. A stealer is a program that collects logins, session tokens, wallet data and files from the PC it runs on and sends them to its operator.
We found no vendor write up under the name Zero Stealer, so we cannot list what it takes or where it sends it. Plan for the worst case: treat accounts used on that PC as exposed.
I downloaded a .jar from this page but did not run it. Am I infected?
A file that was only downloaded does not run by itself, so you are probably not infected, but we cannot promise that. Check that you did not put it in the Minecraft mods folder and start the game, because that runs it.
Delete the file, empty the Recycle Bin, and run a normal Microsoft Defender scan. If you are unsure whether you ran it, do the checks on this page and change your passwords from another device.
I ran one of the files. What should I do first?
Close Minecraft and disconnect the PC from the network. From another device, change the password of your email first, then Microsoft, Discord, your bank and crypto accounts, sign out of all devices and turn on two factor sign in.
Then run a Microsoft Defender Offline scan on the PC, delete the file, and reset Windows with Remove everything if you are not sure. Do the password changes on a clean device, not on the PC.
Can a Minecraft mod really steal my passwords?
Yes. A mod is Java code that runs inside the game with the same file rights as your Windows account, so it can read browser profile folders and launcher files.
Security Affairs describes a campaign in which malicious Minecraft mods led to Java stealers that extract Minecraft and Discord data and a .NET stealer that goes after browser credentials and wallets. Whether the files from this page do the same is not confirmed.
Does this affect Mac, Linux, iPhone or Android?
A .jar file is a Java program, and Minecraft Java Edition runs on Windows, Mac and Linux, so we cannot rule out other desktop systems. We found no source that says what these nine files do there.
On an iPhone or an Android phone you cannot install this kind of mod, and no source mentions them. If you ran a file on a Mac or Linux PC, change your passwords from another device.
Will resetting Windows remove it, and are my accounts safe afterwards?
A reset with Remove everything removes the programs and startup entries, which is the answer that does not depend on finding every piece. It does not undo what was already taken.
Passwords, session logins and crypto seed phrases that a stealer saw stay exposed until you change them from another device and turn on two step sign in. Restore documents by hand, not a full system image, and download Minecraft again from the official source.
The file addresses are offline. Does that mean the danger is over?
No. Offline means the files could not be fetched when the data was last read. It says nothing about copies that people already downloaded, or about the same files on another page, and a page owner can upload new ones.
If you ran a file before the addresses went offline, the risk to your accounts is the same as before. Check your accounts and your PC as described on this page.
Will Fortect remove donutsmpclientts.lovable.app?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For donutsmpclientts.lovable.app, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) (read October 17, 2026)
- Microsoft Support: Recovery options in Windows (Reset this PC) (read October 17, 2026)
- FTC: Email or social media hacked? Here's what to do (read October 17, 2026)
- Security Affairs: Malicious Minecraft mods distributed by the Stargazers DaaS target Minecraft gamers (read October 17, 2026)
- Triage sandbox report: Fabric mod .jar classified as WeedHack RAT (a different name; used only for the behaviour of similar mods) (read October 17, 2026)