exportconsthtml=`<p>This is a disclosure of a malicious mod discovered to be hosted on the Modrinth platform. It is important to not panic or jump to conclusions, please carefully read the <a href="/news/article/windows-borderless-malware-disclosure/#am-i-affected" rel="noopener nofollow ugc">Am I Affected?</a> and <a href="/news/article/windows-borderless-malware-disclosure/#threat-summary" rel="noopener nofollow ugc">Threat Summary</a> sections.</p><h2>Am I Affected?</h2><p>If you run <strong>Windows</strong> and have downloaded a mod called "<strong>Windows Borderless</strong>" (specific files listed below) between May 4th, 2024 and May 6th, 2024 and have run the game with the mod installed, you are affected.</p><p><strong>IMPORTANT NOTE:</strong> This mod is called, exactly, "Windows Borderless". There are other mods with similar names on Modrinth, which are <strong><em>NOT</em></strong> malware, such as "Borderless Mining", "Borderless", and "Borderless Mining Reworked".</p><p>If you have not downloaded that mod or do not run Windows, there is no reason to believe you are at any risk. We have released a detection tool <a href="https://github.com/modrinth/oracle/releases/download/v0.0.1/ModrinthMalwareScanner.exe" rel="noopener nofollow ugc">available here</a> which can scan your mods folder for the malicious files if you wish to make sure your instance does not have the mod. The tool is also <a href="https://github.com/modrinth/oracle" rel="noopener nofollow ugc">open-source</a>.</p><p><strong>Download and run the detection tool <a href="https://github.com/modrinth/oracle/releases/download/v0.0.1/ModrinthMalwareScanner.exe" rel="noopener nofollow ugc">here</a>!</strong></p><h3>What do I do if I have used the "Windows Borderless" mod?</h3><p>First, delete the mod entirely from your computer.</p><p>The mod harvested data stored by many Chromium-based projects such as <strong>Google Chrome</strong>, <strong>Discord</strong>, <strong>Microsoft Edge</strong>, and many other browsers such as Opera/Opera GX, Vivaldi, Brave, Firefox and over dozen more. Included in this data may be <strong>account tokens</strong>, <strong>stored passwords</strong>, <strong>banking information</strong>, <strong>addresses</strong>, and more.</p><p>In order to protect yourself, change all of your passwords, and keep an eye out on your bank accounts and credit cards.</p><h2>Threat Summary</h2><p><strong>Exposure level:</strong> Low, ~372 distinct IPs downloaded affected files. One Discord account is alleged to have been stolen due to this.</p><p><strong>Malware severity:</strong> Medium (Discord, browser, and system info stealer, but does not self-replicate)</p><p><strong>Projects affected:</strong></p><table><thead><tr><th>Name</th><th>Project ID</th><th>Former URL</th></tr></thead><tbody><tr><td>Windows Borderless</td><td><code>ZQpQzwWE</code></td><td><code>https://modrinth.com/mod/windowsborderless</code></td></tr></tbody></table><p><strong>Files affected:</strong></p><table><thead><tr><th>Name</th><th>SHA1 Hash</th><th>Version ID</th><th>Download count</th></tr></thead><tbody><tr><td><code>windowedborderless-v0.2 - 1.20.4.jar</code></td><td><code>179b5da318604f97616b5108f305e2a8e4609484</code></td><td><code>NkTbhEmf</code></td><td>116</td></tr><tr><td><code>windowedborderless-v0.3 - 1.20.4.jar</code></td><td><code>1a1c4dcae846866c58cc1abf71fb7f7aa4e7352a</code></td><td><code>v87dk8Q7</code></td><td>15</td></tr><tr><td><code>windowedborderless-v0.4 - 1.20.+.jar</code></td><td><code>e4d55310039b965fce6756da5286b481cfb09946</code></td><td><code>pVfdgPhy</code></td><td>68</td></tr><tr><td><code>windowedborderless-v0.4 - 1.20.+.jar</code></td><td><code>2f47e57a6bedc729359ffaf6f0149876008b5cc3</code></td><td><code>Wt4RjZ49</code></td><td>119</td></tr><tr><td><code>windowedborderless-v0.4.1_-_1.20.+.jar</code></td><td><code>2f47e57a6bedc729359ffaf6f0149876008b5cc3</code></td><td><code>oIlYelrb</code></td><td>1</td></tr></tbody></table><p>None of these files were included in any modpa
