Gamers Beware: Potentially Massive Phishing Attack on “Minecraft” Users Discovered

IntSight’s “CRT” researchers have discovered evidence that suggests a global phishing attack is being planned against “Minecraft” users. At the time of this blog’s posting, it is not known who is planning the attack. Evidence of an attack in the planning stages consists of a list of 268 email addresses and 31 Twitter accounts found on a paste site on February 20, 2018. “Minecraft” was developed by Mojang AB - Swedish gaming company founded by Markus “Notch” Persson, Carl Manneh and Jakbok Porser. Microsoft acquired rights to Minecraft from Mojang in 2015.

Red flags, but under the radar

The list was discovered a post on a paste site on February 20, 2018. Although Minecraft is no longer owned by Mojang AB, Minecraft remains one of the most popular computer games in the world with millions of users. As stated above, the list contains 268 email address and 31 Twitter accounts. Two-hundred and fifty of the email addresses of the 268 appear to designed for use in a phishing attack and are formatted as: [email protected]{WEBMAIL}.coX. Our assumption is that the attackers want to go under the radar and thus are choosing not to use or domains which are very likely being monitored for such a possible attack.


It is a known fact that Minecraft is one of the most successful games ever released and has millions of users around the world. Because of its success, it is our assumption that who ever is planning the attack is doing so in an attempt to distribute malware, crypto miners, or ransomware.

Another possibility is these emails have been been created as a continuation of the cyber war that began between rival Minecraft communities in 2017.

Email Address Examples

Screen Shot 2018-02-26 at 9.26.50 AM.png

Screen Shot 2018-02-26 at 9.26.58 AM.png

Screen Shot 2018-02-26 at 9.26.40 AM.png

Stay up to Date!

Subscribe to the blog to stay up to date with all the latest industry news and updates from IntSights.