Lunar Client Modrinth Chain Exploit - Unexpected Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects anomalous child process execution spawned by Lunar Client or associated Java runtime processes, typically stemming from a malicious Modrinth modpack. This exploit path leverages Electron framework vulnerabilities to execute arbitrary system binaries (e.g., cmd.exe, powershell.exe, explorer.exe) via shell commands triggered by modpack installation or execution.