Lunar Client Modrinth Chain Exploit — Unexpected Child Process Spawned

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects Lunar Client spawning suspicious child processes or command lines, which is characteristic of exploit chains like 'lunar-modrinth-chain-poc'. These attacks typically leverage renderer vulnerabilities to execute shell commands, .lnk files, or arbitrary binaries via abused APIs like shell.openExternal or malicious modpack overrides.