Are Minecraft mods safe? What the October 2026 malware means
Are Minecraft mods safe after 34 malware projects hit CurseForge and Modrinth in October 2026? How to check your mods folder and what to do next.
Published 6 min readby the Synagy team, written with AI
Short answer: most Minecraft mods are safe, but not all of them. Between 20 and 27 October 2026, 34 Minecraft projects with malware were removed from CurseForge and Modrinth. Six Modrinth mods installed a hidden browser extension that recorded passwords. Check your mods folder against the public list, stick to well-known authors, and treat brand-new mods from brand-new accounts with care.
We make Synagy, a tool that builds Minecraft mods with AI. We have no stake in CurseForge or Modrinth. Every number below links to the report it comes from.
What happened in October 2026?
Two waves of malware were found in one week. Both were reported by Modgrade's malware reports, a third-party mod scanner, and by an outside researcher called Haxy.
The main facts, as of 31 October 2026:
- The big list: Modgrade lists 43 project entries, 25 on CurseForge and 18 on Modrinth. Its headline count is 34 projects that were still online. Every one has been removed from the site where it was found.
- The most downloaded: "Weaker day zombie" on Modrinth had 205,406 downloads. "Full Bright" on CurseForge had 134,688. The CurseForge files of Weaker day zombie are clean and still online.
- The worst type: six small Modrinth mods, reported on 26 October and removed on 27 October. The report on the six Modrinth mods names them: Hard Crafting, Mob Scale Randomizer, Choose Player Size, Something in the Ground, Damage Calculator and Ender Pearl Timer.
- The bans: CurseForge removed all 25 of its listed projects on 24 October and banned the authors a day later.
How did the malware get in?
The trick was patience. Six new accounts each uploaded one small mod between 31 May and 24 June 2026. Version 1.0.0 was clean, so it passed checks. Version 1.0.1 arrived one to seven days later and added the bad part.
That update did not contain the stealer itself. When the game started, the mod asked a website for an "update" and ran whatever came back, without checking a signature. The downloaded program then closed Chrome, Edge, Opera, Opera GX and Brave. It installed an extension in every profile that logged typed passwords, cookies and visited pages. Firefox was not targeted.
This is not new. Modrinth published a disclosure about the Windows Borderless mod in May 2024. It used the same pattern: clean first upload, bad files later. Those files had 319 downloads before staff removed them. In June 2023, the fractureiser malware spread through mods on CurseForge and BukkitDev.
How do you check your Minecraft mods folder?
Open your mods folder and compare every file with the public list. If you are unsure where the folder is, our guide on how to install Fabric mods on Minecraft 26.3 shows where to find it.
- Open the mods folderin every launcher and every modpack instance you use
- Compare the nameswith the projects on the Modgrade malware list
- Check your browsersremove extensions you did not install and turn off developer mode
- Look for leftover foldersChromeDevAssist in AppData and ProgramData on Windows
For the six Modrinth mods, the report lists these Windows paths to delete after closing the browsers:
%LOCALAPPDATA%\ChromeDevAssistC:\ProgramData\ChromeDevAssist%LOCALAPPDATA%\Microsoft\Windows\Explorer\iiconcache_widemod_2560.db
On a school or work computer, first run the .reg backup file in C:\ProgramData\ChromeDevAssist\policy-backup-*. It restores the browser rules the malware removed.
What should you do if you ran an infected mod?
Act today, in this order. The steps below follow the advice in both Modgrade reports:
- Remove it: delete the mod file, then run a full antivirus scan.
- Sign out everywhere: end all sessions on your Microsoft and Discord accounts.
- Change passwords: change every password you typed into a browser since you installed the mod. Change saved browser passwords too.
- Turn on two-factor login: use it on Microsoft, Discord and your email first.
- Call your bank: do this if you entered card details on any website after installing the mod.
How do you pick safe mods from now on?
Most risk comes from a few clear signals. Use this table before you download anything:
| Signal | Lower risk | Higher risk |
|---|---|---|
| Author | Known name, many projects, years of history | Account made minutes before the upload |
| Downloads | Thousands, with comments from real players | Few downloads, no comments |
| Updates | Changelog that explains each version | Small update right after release, no notes |
| Source code | Public repository you can read | No source at all |
| Where from | CurseForge, Modrinth or the author's own page | Reupload sites and Discord links |
None of these signals is proof. Weaker day zombie had more than 200,000 downloads on Modrinth and still carried malware. Treat downloads as one hint, not a guarantee.
If you build a pack for friends, add fewer, better-known mods. Our guide on how to make a Minecraft modpack explains how to share a pack through Modrinth or CurseForge.
Where does Synagy fit, and where does it stop?
Synagy makes your own mod instead of downloading a stranger's. You describe the mod in one line inside Minecraft: Java Edition 26.2 with Fabric. Each part is game-tested before it is charged, and you keep a .jar with the full source code. You can read every line or ask someone you trust to read it.
Mods other players publish on Synagy go through a check first. Mods made only from Synagy building blocks pass an automatic check. Mods with their own Java code are reviewed by the Synagy team before they go live.
Where it stops:
- No scanner: Synagy does not scan the mods you already have. Use the steps above for those.
- Java only: Synagy builds for Java 26.2 with Fabric. Bedrock, Forge and NeoForge are not supported yet.
- One version today: ports to 26.3, 1.21.1 and 1.20.1 are in development but not live. The six Modrinth mods targeted versions such as 1.21.11 and 1.20.1.
Every free account gets 25 Free Credits a day, and payments are paused during the free beta. Details are on the Synagy for Minecraft page and the pricing page.
FAQ
Are Minecraft mods safe to download?
Most are, but not all. In October 2026, 34 projects with malware were removed from CurseForge and Modrinth. Download from known authors, read comments and changelogs, and check your mods folder against public malware lists after a warning like this one.
Are CurseForge Minecraft mods safe?
CurseForge removed all 25 of its listed malware projects on 24 October 2026 and banned the authors. Most CurseForge mods are fine. Still, both CurseForge and Modrinth had malware this month, so no site is a guarantee on its own.
Can a Minecraft mod steal my passwords?
Yes. A Java mod runs with the same rights as the game. The six Modrinth mods from October 2026 installed a browser extension that recorded typed passwords and cookies in Chrome, Edge, Opera, Opera GX and Brave.
Does antivirus software catch malicious Minecraft mods?
Not reliably. The October 2026 mods downloaded their harmful code only after the game started, so the mod file itself looked harmless. Even Modgrade's mod scanner first marked them as "Passed". Use antivirus as one layer, not the only one.
Written with AI and checked automatically before publishing, without a human editor. Spotted a mistake? Tell us and we fix it.
