freeclients.net: fake Minecraft client downloads tagged SilentNet, and what to do if you ran one of the .jar files on Windows

What freeclients.net is, and what we know about it

freeclients.net is not a program on your PC. It is a website whose title, in our request on 17 October 2026, read Free Minecraft Clients, Download Cracked PvP Clients (Meteor, Krypton, ThunderHack). The abuse.ch project URLhaus lists 15 files from its downloads folder as malware. We found no public write up of this one address, so this page separates what URLhaus shows, what we saw ourselves and what researchers have published about the same tag.

1. 1

   What URLhaus lists

   Fifteen file addresses under /downloads/ on freeclients.net, each ending in .jar. The names are those of well known Minecraft clients and cheats, for example meteor-client-1.21.5-54.jar, KryptonClient1.21.11.jar, ThunderHackClient-1.20.4-1.21.11.jar, SakuraClient-1.20.4.jar and Astralux.jar. All 15 were added within six seconds on 23 September 2026 (about 07:23 UTC) by one reporter, and all carry the threat label malware_download and the tags jar and SilentNet.

2. 2

   What the tag means

   SilentNet is a label that malware analysts and sandbox services attach to trojanized Minecraft mods. Public sandbox reports we found describe it as a Fabric style mod that steals the Minecraft session token, downloads and runs further payloads and keeps itself running. These are automated and community analyses of other samples, not a vendor write up, and we could not open the 15 files ourselves.

3. 3

   What we could not confirm

   We did not download any file, so we cannot say which of the 15 files really contain the code, whether the names on the site still point to the same files today, or what each one does. URLhaus shows tags, not proof. We also do not know whether the site owner made the files or whether a copy was swapped in without the owner knowing.

4. 4

   What this means for you

   If you only saw the name in a log, a blocked request or a search result, you are not infected by that alone. The risk belongs to a PC where someone downloaded one of these clients and started it with Java. All 15 addresses are marked offline in our data, which means the files were not downloadable from those paths when URLhaus last checked. A person who downloaded one before that is still at risk.

Kind of threat

A site that hands out cracked Minecraft clients; URLhaus lists 15 of its .jar downloads as malware, tagged SilentNet

Where the files were

hxxps://freeclients[.]net/downloads/<name>.jar (for example Noxx-Client.jar, Luminex.jar, Nyrex.jar, RadiumClient-1.21.jar)

Domain registered

15 January 2026 through Cloudflare, Inc.; status client transfer prohibited (RDAP, read 17 October 2026)

URLhaus entries

15 file addresses, all added on 23 September 2026 between 07:23:18 and 07:23:23 UTC; all 15 marked offline in our data

Site today

A plain request from our server on 17 October 2026 got HTTP 200 and a page titled as above, behind Cloudflare. The page is up even though the listed files are marked offline

Platform

A .jar runs wherever Java runs, so Windows, Mac and Linux players can all be reached. The reports we read describe Windows victims; see the section on other devices

What we checked on 17 October 2026, and what we could not

Our check was one plain request from our server to https://freeclients.net/. It was not a browser visit, we clicked nothing and we downloaded nothing. That clears nothing: a plain request cannot show pop-ups, redirects after a click or what a download button does.

freeclients.net from registration to today

The domain is about nine months old and all the reports come from one moment. The dates come from RDAP and the URLhaus data we hold; times are UTC.

1. 15 January 2026

   The domain is registered

   RDAP shows freeclients.net registered on 15 January 2026 through Cloudflare, Inc. The only status flag is client transfer prohibited, which is a normal lock and says nothing about the owner.

2. 23 September 2026

   Fifteen .jar files are reported in six seconds

   Between 07:23:18 and 07:23:23 UTC a single URLhaus reporter adds 15 addresses under /downloads/. Every entry has the tags jar and SilentNet. The speed suggests the reporter went through the whole downloads folder with a script or in one session. That is our reading of the timestamps, not something a report says.

3. After 23 September 2026

   The files go offline

   In our copy of the data all 15 entries are marked offline. We do not know when each stopped answering or why: removal by the site, a changed path or a block by the host are all possible.

   

4. 17 October 2026

   The home page still answers

   Our plain request gets HTTP 200 with the page title about free cracked Minecraft clients. No new URLhaus entries have been added since 23 September in our data.

No refresh of the reports does not mean the danger ended. It means nobody has reported newer files to URLhaus that we hold. If the site still offers downloads, the files behind the buttons could be different from the 15 listed.

How a Minecraft client file can steal an account

A .jar file is a Java program. When you start a client, you start a program with the same rights as you, and nothing in Windows stops it from reading your files. We did not open the 15 files; this is how researchers describe Minecraft mod malware in general, and what sandbox reports say about SilentNet.

1. 1

   The bait is a free client

   Cheat clients such as Meteor, Krypton or ThunderHack are popular with players who want an edge on servers. Meteor Client is a known open source project, and that is part of the problem: a download page can use a famous name for a modified copy. Check Point Research (June 2025) described fake Java cheat mods, called Oringo and Taunahi, hosted on GitHub by the Stargazers Ghost Network and aimed at Minecraft players.

2. 2

   Java starts the file

   The player puts the .jar in the mods folder of a launcher such as Fabric, or double clicks it. Check Point reported that the Java loaders in that campaign ran only on systems where Minecraft is installed, which helps them avoid analysis sandboxes. A modified client also looks normal in game, because it still contains the real features.

3. 3

   The session and files are read

   The sandbox reports we found for SilentNet describe stealing the Minecraft session data, that is the username, the player ID and the access token. A stolen token can let someone act as your account without your password. Bitdefender (June 2023) described the older Fractureiser campaign taking cookies and passwords from browsers and Microsoft, Minecraft and Discord logins.

4. 4

   More code is fetched

   The same sandbox reports describe downloading and running extra payloads, hiding as another Java process and starting again with Windows. One summary describes a blockchain based command channel. We could not read the underlying pages in full and treat these details as unconfirmed for the 15 files here.

5. 5

   The loader can spread

   Bitdefender and the Fractureiser research team reported that code in that campaign could infect other .jar files on the PC, so a second mod you trusted could be changed. We do not know whether SilentNet files do this, but it is a reason to check every mod, not only the one you suspect.

The 15 reported files, listed

The list below is exactly what URLhaus holds for freeclients.net. If you downloaded a file with one of these names, from this site or from a copy of it, treat it as suspect. A file with the same name from another place could be harmless or not; the name alone does not say.

What a stealer like this can take from a PC

The list below is what the sources say for Minecraft mod malware in general. Not every item is confirmed for the freeclients.net files, because we could not open them.

What this can cost you

Seeing the name costs nothing. The risks below apply to a PC where a client from this site was started.

• High

  Your Microsoft account

  Minecraft Java accounts are Microsoft accounts. Taking one over can expose your mail, Xbox profile, purchases and any other service that uses the same sign in.

• High

  Your Discord and other logins

  Stealers in this class read browser data and Discord data. A stolen Discord session is often used to message your friends with the same malware, which is how these clients spread.

• High

  Crypto and money

  Wallet files, saved seed phrases and the clipboard replacement trick are named in the Fractureiser write up. Crypto that is sent cannot be brought back.

• Medium

  Other mods and files

  Infected .jar files in other places on the same PC are possible if the code spreads, and more malware can be downloaded after the first file.

• Medium

  Servers you moderate or own

  If you run a server and your PC held server files, panel logins or plugins, treat those as exposed. Server plugins are also .jar files, so the same caution applies to them.

• Low

  Nothing, if you only saw the name

  A name in a log, a warning or a search result is not an infection.

What you may notice, and what you may not

Stealers are built to be quiet. The signs below are possible, none is certain, and many victims notice only when an account is taken.

Who can meet this, and how

The people at risk are players who download free or cracked clients, and anyone they share them with. A visitor who only read the page, or a site owner whose pages are fine, is not in this group.

1. 1

   You downloaded a client from the site

   The site offers cracked PvP clients with names of real projects. If you downloaded and started one of the 15 listed files, you are the main case.

2. 2

   A friend or a server sent you a .jar

   Check Point describes the Stargazers network as running fake repositories, and sandbox reports show the same file names on several sites. A file sent in Discord or a clan chat can be the same file.

3. 3

   You found the name in a log or a scanner

   If our /check tool or a scanner showed you this name, the question is whether any device on your network asked for it. A router or DNS log shows only that a device asked, not that a file ran.

4. 4

   You own the site or run a similar one

   If you own freeclients.net, or a site that looks like it, and you believe your files are clean, the listing may mean a file on your server was replaced or hosted by someone else. Check your files against clean copies from the original project, review who can upload, rotate your passwords and ask URLhaus to look again once the files are cleaned. We cannot tell from outside which case it is.

Check your PC before you delete anything

Start with one question: did you ever start a .jar from freeclients.net? If yes or not sure, do the checks below. None of them deletes anything.

While you check, do not log in to banking, mail or Discord on this PC. If the answer is clearly no, you can stop here.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A stealer that is still running needs the connection to send data out or to fetch more code.

2. 2

   Find the files

   Open the Minecraft launcher folder (press Win + R, type %appdata%\.minecraft and press Enter) and look in mods. Write down the names of every .jar and when it was added. Also look in Downloads for the names in the table above. Do not open them.

3. 3

   Look at Task Manager

   Press Ctrl + Shift + Esc with the game closed. On the Processes tab, look for javaw.exe or Java(TM) Platform SE binary. Java running while Minecraft is closed is worth a closer look. Right click it and choose Open file location to see where it started.

4. 4

   Check what starts with Windows

   Open Settings > Apps > Startup and switch off nothing yet; just write down anything you did not install, especially names that look like Java or a random word. Then press Start, type Task Scheduler and look in Task Scheduler Library for tasks that run javaw.exe or a script from your user folder.

5. 5

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything Defender blocked or quarantined around the day you downloaded the client. A detection there is useful; no detection clears nothing, because new stealers are often not caught on the first day.

6. 6

   Check your accounts from another device

   From a phone or a different PC, open your Microsoft account sign in activity, your Discord login devices and your email. Look for sign ins you do not recognise. This is quicker than any file check and tells you if the data was already used.

7. 7

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. No vendor we found publishes a removal procedure for these files, and we did not infect a PC, so the order below is our judgement, not a tested result.

If you use a Mac, Linux, an iPhone or an Android phone

A .jar file is not tied to Windows, but the details we found describe Windows victims. Do not run the Windows steps on another system.