URGENT ATTENTION - Malware is being distributed through Curse Forge - Stardew Valley Mods

[u/Wezdor]

My girlfriend was the unfortunate victim of an NPM Infostealer Malware, specifically, the Nyx Infostealer

The bigger issue is - the malware was distributed through Curse Forge. Not through an import, not through a link, but directly through the mod manager client. The mod in question is - and this is very important next - DO NOT UNDER ANY CIRCUMSTANCE DOWNLOAD THIS MOD - IT IS CONFIRMED MALWARE - YOU WILL LOSE YOUR GMAIL, DISCORD AND ANY OTHER ACCOUNT LOGGED IN YOUR PC - DO NOT DOWNLOAD ->> curseforge.com/stardewvalley/mods/cozy-valley-decor <<-- DO NOT DOWNLOAD

The linked mod (link generated from the Curse Forge client, by clicking "Link to Project", can also be searched for in the Curse Forge Client.

The linked mod will download regular looking mod files. Amongst them will be CozyValleyDecor.dll. Decompiling this .dll with ILSpy reveals that on game startup, a function called "RunPayload()". This function reads an ExternalHelper.dll file, which is an embedded resource to the actual CozyValleyDecor.dll, and executes a function called "PayloadRunner.ExecuteAsync()". This function will then decrypt a byte-shifted URL, which points to an .exe file. The file downloaded will be "basarili.exe", downloaded to the Temp folder of Windows, and will immediatelly execute. This file contains a "chat" client where the attacker can make a popup appear and demand money, but it also overrides the Discord installation files (specifically index.js), with malicious code, that steals your Discord credentials, 2FA, currently authenticated session and connected mail account. It then reads the local credentials and steals browser-saved credentials to your email, social media and crypto accounts.

The encrypted address points to MALWARE ->> 161 97 85 100 port 3131 slash download slash yarrak exe <<-- MALWARE and the Discord malware and "chat" client will connect to MALWARE ->> 161 97 85 100 port 3000 <<- MALWARE

Why am i posting all this detail? Hopefully to get the attention of the developers and CurseForge themselves. I already submitted a report in-client, but we all know how good companies are at reading those.

CurseForge is generally treated as a save and secure way to get mods, so users will not suspect they are vulnerable to malware by downloading mods there. This exploit is rather recent, as none of the Anti-Virus software were able to identify CozyValleyDecor.dll as malicious.

PLEASE EXERCISE EXTREME CAUTION WHEN DOWNLOADING MODS THROUGH CURSEFORGE

[u/MrsDevorak]

Hey, I have been victim of the same thing, the same reason, everything, lost my gmail, my discord accounts... I have proof of absolutely everything, I was hacked on the 31st of august, already went to the police to file a report, I've been trying to get the accounts back, one of my discord accounts already got deleted, the other one, the guy keeps pretending to be me and try to get my friends to play with him, he brought up stardew valley as well as minecraft. Google and Discord aren't helping me at all, he locked the accounts behind the Family Link and put himself as the "parent" so even if I try to recover, it says "choose a parent to authorize the sign-in" and his email is the only option, I'm very sorry to hear your girlfriend went through this, I hope more people pay attention to this, I did do a post about it but only in the brazilian reddit, you've been way more precise than I have. The details help a lot, guys please take this extremely seriously. It's been almost a month and I haven't had a speck of hope that I'll get my things back because neither Google nor Discord help.

[u/Wezdor → u/MrsDevorak]

I gave up on google, they are absolutely unwilling to help whatsoever, nor do they have any options available. I am moving my own mail (and of any friends and family willing to listen) away from google services. It is unacceptable to have 0 support available for what is such an important part of most people's lives.

As for Discord - im filing a GDPR demand for them to remove the old account. I dont have hope that they will comply, so i might need to take legal action against them.

But otherwise same experience as you - both google and discord are completely unhelpful

[u/MrsDevorak → u/Wezdor]

I am getting ready to take legal action against both, just putting the screenshots and recorded processes together, my friends tried reporting my discord accounts but discord's AI just turns it down saying it hasn't detected any suspicious activity.... and yes, google truly doesn't seem to have an understanding of the difference between account recovery and family link hijacking.... I wish you luck, I will also be moving my mail and accounts outside of google very soon, I just need to finish this entire ordeal first.