Fake DonutSMP cheat clients are spreading password-stealing malware (Nov 3, 2026)

November 3, 2026. Security researchers have tied a live malware campaign directly to DonutSMP players. On November 2, the malware analysis teams behind Threat.Zone and Malwation published an update to their SilentNET report: a YouTube video titled "How to cheat on donutSMP" sends viewers to a fake "Mod hub" site that serves eleven trojanized Minecraft "cheat clients". Install one and you don't get a cheat. You get an infostealer.

This is not connected to the DonutSMP server team. It is a third party using the server's popularity as bait.

What researchers found

• The lure: a YouTube video, "How to cheat on donutSMP", published October 15, 2026. The description promises "the best cheat client" and points to the comments, where the channel's own comment links to the download site.
• The site: a fake mod portal hosted on Netlify (an earlier copy ran on Vercel). It lists eleven "clients" for Minecraft 1.21, 1.21.11 and 26.1.2 as .jar files. Researchers say it was still online at the time of their update and has been reported to the host.
• The trick: the download dialog tells you to open %appdata%, find .minecraft\mods, drop the jar in, and launch with a mod loader. You never run the file yourself. Minecraft runs it for you.
• Earlier wave: in late September, the abuse.ch URLhaus project listed seven jar files from a site named after DonutSMP (Krypton, "fakepay", Doomsday and copies of well-known clients) as malware tagged SilentNET. Broadcom's security bulletin also describes SilentNET posing as a hacked "Krypton Client" promoted to DonutSMP players.

We are deliberately not linking the malicious sites or the video.

What SilentNET steals

According to the published analyses, SilentNET is sold as a service and can grab:

• Minecraft and Microsoft account tokens
• Discord tokens
• saved browser passwords and session cookies (Chrome, Edge, Firefox)
• crypto wallets and FileZilla logins
• screenshots, and on some builds remote control, keylogging, webcam and mic

Malwation reported the whole browser sweep took about two seconds, and the loader had zero detections on VirusTotal when they tested it. Stolen session cookies can open accounts without a password or a 2FA prompt. "My antivirus said it's fine" means nothing here.

Why "cheat clients" make perfect bait

People looking for a cheat already expect unsigned jars from random sites and are used to ignoring antivirus warnings. That is exactly the habit this campaign abuses. And even a "real" cheat client breaks DonutSMP's rules on client modifications and can get you banned (see our client mods rules explainer and fair play ban FAQ). So it's a lose-lose.

If you installed one: do this now

1. Delete the jar from .minecraft\mods and stop launching that profile.
2. From a different, clean device, change your Microsoft (Minecraft) password, your email password and your Discord password. Then sign out of all sessions everywhere, because stolen cookies keep working until you do.
3. Turn on 2FA, or re-set it up, on Microsoft, email and Discord.
4. Move anything valuable out of browser-based crypto wallets using a clean device.
5. Scan and clean the PC. If you're not sure, a full Windows reset is the safest option.
6. Warn friends. Infostealers often spread the same link from hijacked Discord accounts.

How to stay safe

• Download mods only from the developer's official page or trusted hosts like Modrinth or CurseForge. A YouTube comment link is not a source.
• Any guide that says "disable your antivirus" or "drop this jar into mods" from an unknown site is a red flag.
• Same idea as the fake verification Discord scams we covered last week: nobody needs your Microsoft login codes to give you free stuff.
• Lock down your account with our account security checklist.

If you want money on DonutSMP, the safe route is playing and trading carefully. Never a "free" jar.