HypixelSkyblock.net Deep Dive

Here is a more in depth analysis of the computer side of this from somebody who has been combatting this scam for a while, give it a read if you're interested!

From: Angry_Pineapple#6926

Hey DK! I just saw your video posted recently (https://youtu.be/3K2bRLx9zY0) about hypixelskyblock.net and I'd like to give some more information and maybe inform you on some things that you might not know,
I actually have been working to combat this scam, ever since it was put up about 2 weeks ago. I've been working with a group of talented people in the SkyClient Discord, along with a security researcher friend to deconstruct this scam.

When I first saw the link, I immediately opened it, downloaded the file, and decompiled it. I saw a bunch of garbage code (intended to confuse people trying to find malicious code) layered inside the file. The first revisions of this "mod" contained;
- Minecraft session stealer (looks through launcher_accounts.json, finds email and password, then sends it to a remote webhook).
- This mod wouldn't load correctly in Minecraft due to all of the garbage code, causing crashes.

I found their webhook url and started to spam it. Then I realized what they were doing. Every time I'd send messages to the webhook (via a Discord tool, webhooks can have data sent to them or remotely deleted), they would remove the webhook, and upload a new file. Eventually I was tired of spamming the webhook, so I made a script to automatically download, decompile, find the webhook in the class file (class file is an element in a Java program, basically think of it as a 'section' of code), then automatically delete the webhook so that even if an unsuspecting user did download and run the mod, their details wouldn't be sent due to the webhook being invalid.

However, they quickly found out what I was doing, and obfuscated (makes the code nearly unreadable for decompilers and humans), so I could "no longer delete the webhook", and the creator of this mod (REDACTED) sent disturbing and inappropriate messages to me and the rest of the people I was working with. We were eventually able to automatically deobfuscate and continue to delete the webhooks, to prevent anyone's credentials from being logged by the modification.

At this point, we found their "contact" form and started spamming it. And when I mean spamming it, I mean really spamming it. I alone sent over 45,000,000 requests to their form, causing their hosting provider to immediately suspend their service and shut down their website. However, they quickly got it back up on Google Sites, which has anti-spam protections. However, you are able to report Google Sites via an abuse form, however Google does not act quickly upon this.

Now we're at today. The mod download is still online, but it is currently impossible for me to find the webhooks that data is being sent to, since they have obfuscated the mod further (similar to SkyblockExtras), making it impossible for me to find anything of value inside of the mod. What I currently know about the mod is that;
- It logs Minecraft session IDs
- It logs Discord tokens
- It (attempts) to log Chromium, Firefox, Opra, and Edge password information
- All data is being sent to a Discord webhook in the "official server" in a private channel.
- There is a form of Trojan installed in the mod, which attempts to do other malicious things (detected by some Anti Virus programs)

Thank you for posting an informative video about this malicious software! This is just a couple things I've found while researching this harmful modification.

Thank you!