Are Minecraft mods safe? Mostly, if they come from the right place. But a mod isn't a texture or a map. It's code that runs on your PC, and the people who investigated the 2023 fractureiser outbreak put it bluntly: "Java mods are simply bundles of arbitrary code: treat them like an .exe, they can do anything." So the real question isn't whether mods are safe. It's whether this particular file, from this particular place, is.
The short version: stick to Modrinth, CurseForge or the mod's own official page, don't run anything somebody sends you in a DM, and don't assume a clean antivirus scan means you're in the clear. The rest of this page is the why, plus a checklist.
Why mods are different
If you only play vanilla Minecraft through a trusted launcher and have never touched a mod, the fractureiser investigators say you're fully safe from that outbreak. Adding a mod changes that. Once it's in your mods folder, it runs with the game, and it can do whatever a program can do. The same investigators say antivirus inside the mod loader probably isn't viable, and that sandboxing Java here is pretty much impossible.
That's why I treat a mod download like I'd treat any program download from the internet. Shaders and Bedrock packs have their own wrinkles, so I covered those separately: are Minecraft shaders safe and is MCPEDL safe.
Can Minecraft mods have viruses? Two real cases
fractureiser, 2023: infected files on a legit site
In June 2023, malware was found in mods and plugins uploaded to CurseForge and dev.bukkit.org. The site itself wasn't hacked. According to the investigators, an attacker uploaded innocent-looking malicious mods, a well-known modpack developer downloaded one, and their infected PC then pushed a working project, virus included, to CurseForge as a normal file. That repeated with other creators.
What the malware went after was ugly: browser cookies and logins, Discord credentials, and Microsoft and Minecraft credentials. It also spread to other .jar files on the machine and swapped crypto addresses in your clipboard. The investigators' guidance at the time was that anything downloaded from CurseForge or the Bukkit plugin repository between February and June 2023 should be treated as potentially malicious. They quote CurseForge's Discord putting the infected downloads at roughly 6,000.
Two lessons. First, a trusted site can still host a bad file if an author's account or computer is compromised. Second, the automated checks didn't catch it early; the investigators said preventing this at platform scale wasn't feasible. They also said a copycat was likely. Platform detail is on my is CurseForge safe page, and Modrinth's side is in is Modrinth safe.
2025: fake mods on GitHub that were really stealers
In June 2025, Check Point Research described a campaign it had tracked since March: malicious GitHub repositories posing as Minecraft mods. They looked legit partly because multiple fake accounts had starred them. The lure was cheat and macro-style tools, with names like Oringo, Polar and SkyblockExtras, built as Forge 1.8.9 mods.
You'd drop the .jar in your mods folder, and when the game started it downloaded a stealer that went after your Minecraft and Discord tokens, then another one that grabbed browser passwords, crypto wallets and more. Check Point said the first-stage downloader wasn't detected by any antivirus engine on VirusTotal at the time. The attacker's payload page had more than 1,500 hits, which Check Point used as a rough upper estimate of victims.
The lesson: a clean VirusTotal result isn't a guarantee, and "free cheat mod" is bait. If you're hunting Hypixel SkyBlock mods in particular, my SkyBlock mods guide is the place to start instead of a random repo.
Where the risk actually lives
- Copycat "mod download" sites. The Fabric docs say there are plenty of sites that claim to have mods but are really malware sites, and to avoid them at all costs.
- Links from DMs, Discord servers and video descriptions. Type the site address yourself instead.
- .exe "installers" and ZIPs from strangers. A mod is a .jar you drop in your mods folder. If a "mod" wants you to run an .exe installer, or to import a ZIP modpack a stranger sent you, stop.
- Cheat and "extras" mods from random repos. That's exactly what the 2025 campaign was.
- Updates from small or new authors. A mod being fine last month tells you about last month's file.
Which Minecraft mod websites are safe?
The safest places to get mods are Modrinth, CurseForge and the mod's own official project page. The Fabric docs say most authors publish to Modrinth and CurseForge, that those sites check mods are what they say they are, and that you can report malicious ones and they'll act fairly quickly.
I'd call that best available, not a guarantee. Both sites have had bad files get through: CurseForge with fractureiser in 2023, and Modrinth in 2024, when a malicious update to an already-approved mod stayed up until a user reported it. Trust them as a starting point and still use the checklist. Forge and OptiFine have their own safety pages: is Forge safe and is OptiFine safe.
Before you install a mod: a checklist
- Get it from Modrinth, CurseForge or the author's official page, reached by typing the address or from the mod's own listing.
- Check the author. A long history and lots of downloads beat a brand-new account with one upload.
- Look for the usual signs: real update history, comments, a linked source or project page.
- Be more careful with updates from small authors, and with anything promising cheats.
- Never run an .exe, .msi or .bat to install a mod, and never import a modpack file someone sent you. Get packs from a project page; the best Minecraft modpacks is a decent start.
- Scan it, but don't lean on it. Antivirus and VirusTotal help, and the Fabric docs say not to rely entirely on them.
- Ask. If you're unsure about a source, ask in the mod loader's community. The Fabric Discord has a player-support channel for exactly this.
- If it acts strangely, delete it and report it on the site.
Bedrock add-ons vs Java mods
Fractureiser only affected Java, according to the investigators. Bedrock wasn't hit. They also say you can't be infected through a multiplayer server unless you download mods for it from somewhere else.
On Bedrock, most of what people call mods are add-ons and packs, which Minecraft imports as game data rather than programs you run yourself. Add-ons can still include behavior, so I wouldn't promise they'll never do anything nasty. The practical red flag is the same: a pack never needs an .exe, .msi, .bat or .apk. The risky step is usually the sketchy site's download buttons, which I went through in is MCPEDL safe.
Are Minecraft mods safe for kids?
It depends on who's choosing the files. Here's what I'd do as a parent:
- Sit down and install the first few mods together, so they see what a normal download looks like.
- Make the rule simple: no .exe or .jar files from links, DMs or videos.
- Use a separate non-admin Windows account for gaming if you can.
- Keep strong passwords and two-factor on their Microsoft account.
For the wider picture, see is Minecraft safe for kids, and Minecraft parental controls for the settings side.
If you think you ran something bad
The investigators' advice is to assume the machine is compromised. From a different device, change your passwords, turn on two-factor, and plan to wipe and reinstall. Cleaning one file off isn't enough when stealers have already been through your browser.
FAQ
What is the safest Minecraft mod website?
Modrinth and CurseForge, or the mod's own official page. None of them is a guarantee, so use the checklist anyway.
Is it safe to download Minecraft mods?
Yes, if you get them from those places and treat every file like a program. No, if you're grabbing them from reupload sites or links strangers send you.
Can Minecraft mods have viruses?
They can. Fractureiser in 2023 and the fake GitHub mods in 2025 both did real damage.