Lunar Client Modrinth Malicious Mod Chain – Unexpected Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects when Minecraft-related clients (e.g., Lunar Client, generic Java Minecraft) launch suspicious child processes such as command-line utilities (cmd.exe, powershell.exe, curl.exe) often associated with malicious post-exploitation activity or credential harvesting.