Is CurseForge safe? Mostly yes, with one big catch. The website and the app are the real, official mod host, owned by Overwolf, and the people who investigated its big 2023 malware outbreak say CurseForge itself was never compromised. The risk lives in the files: mods and modpacks are uploaded by other people, and in 2023 attackers got malware onto the site that way. CurseForge says that's been cleaned up, and the community investigation says that particular malware is dead. The live scam today is different. It's somebody sending you a modpack ZIP on Discord and telling you to import it into the app. Don't do that, and the rest of this page is how to stay out of trouble.
If you're setting up mods for the first time, a launcher makes it easier. I've compared them in my roundup of the best Minecraft launchers. And if the thing you're worried about is a cracked launcher rather than a mod site, here's whether TLauncher is safe. If it's a browser copy of Minecraft someone sent you, here's whether Eaglercraft is safe.
What is CurseForge?
CurseForge is a download site for mods, addons and modpacks. It covers Minecraft, but also World of Warcraft, The Sims 4 and other games. The app's download page says "Built by Overwolf", and the footer reads "© 2026 Overwolf". Overwolf owns it. CurseForge's own blog described the move to Overwolf around late 2020.
There are two things people mix up:
- The website at curseforge.com, where you browse and download files by hand.
- The app, which installs mods and modpacks for you. CurseForge's troubleshooting page says it's connected to the same repository as the website.
The download page gives you two buttons for the app: "Download on Overwolf" and "Download standalone". CurseForge describes them as the lightweight standalone app or the Overwolf version with in-game features. Both are linked from CurseForge's own page, and it lists Windows, macOS and Linux downloads. The app shows ads unless you pay for CurseForge Premium, which is the ad-removal option on that page.
Where the risk actually lives
A Java mod is a bundle of code that runs on your PC. The people who investigated the 2023 malware put it bluntly: treat a mod like an .exe, because it can do anything. So the real question is never "is the site safe" but "is this file safe".
The 2023 fractureiser malware
In early June 2023, an attacker went after the modded Minecraft scene. CurseForge's own incident report, published June 19, 2023, says the malware was built to infect only Minecraft mod files (JARs), and that this let it slip past commercial antivirus. It went after cookies, passwords and login details.
It got in through accounts. The attacker made their own author accounts and uploaded infected files. Then a device belonging to a big creator, Lunar Pixel Studios, got infected, and the attacker used that to upload infected files to popular projects under those creators' names. The fractureiser investigation write-up says it hit CurseForge and BukkitDev, was only known to target Windows and Linux, and that the investigators weren't sure whether accounts were breached by brute force or by trojan. CurseForge points at the trojan route.
How bad was it? CurseForge says infected files were downloaded about 6,500 times, out of tens of millions of file downloads a day. The community found the server the malware pulled its payloads from within hours. The investigation write-up says that downloads from CurseForge or Bukkit between February and June 2023 should be treated as potentially malicious, and that the event has ended, with no follow-up versions of it ever found. It also says a copycat is possible, and likely inevitable. CurseForge itself wasn't compromised, they say, only individual users. Bedrock wasn't touched, and you couldn't catch it just by joining a server unless you downloaded mods for it somewhere else.
CurseForge says all the infected files were removed and that the app and site were safe again. That's their statement, but it matches the investigators' account that the incident is over.
What CurseForge says it checks
In that 2023 report, CurseForge described three layers: over a dozen automatic tests, including several antivirus scans; manual moderation, where suspicious files go to a security expert; and community reports through the "Report a Mod" feature. Its current moderation policy page says every project goes through "a series of processors, automated checks, and manual reviewing", adds that moderation is done "under our best efforts", and that anyone can report a project. Its known-issues page says Minecraft uploads can be sent to a malware processor that can take a few days. It also calls itself "the safest and most trusted source for mods", which is CurseForge saying that about CurseForge.
The scam that's live now: fake modpacks
In May 2026, CurseForge published a post called "Stay Safe: How To Spot Suspicious Modpacks And Files". Its point: these attacks aren't coming through CurseForge itself. Scammers impersonate trusted people on Discord and send you a ZIP to import into the app.
The post says CurseForge scans files you download directly through its app or website. It can't scan or verify a modpack ZIP a friend sends you that you import. Its worked example was a ZIP posing as a CurseForge modpack that held a JAR which, per the post, could run PowerShell or shell commands and download more payloads, probably to steal Minecraft accounts, Discord tokens and cookies. The player caught it by running the file through VirusTotal.
The red flags CurseForge lists:
- A ZIP sent through Discord, even from someone you know, with a request to import it.
- Pressure to join a server quickly, or a download described as "required".
- A "modpack" that's suspiciously small.
- Unfamiliar JARs, oddly named files or executables in a modpack's overrides.
CurseForge's support page on shared modpacks says packs not hosted on CurseForge can be manipulated by anyone who's handled the file, and CurseForge can't verify or guarantee them. When you import one, the app warns you if it holds non-CurseForge files. Pick "CurseForge Files Only", which the support page calls the recommended safe option.
Why your antivirus might flag something
Antivirus gets nervous about Java mods because a mod really is arbitrary code. The investigators said early scanning heuristics had a lot of false flags on popular mods like Quark. And CurseForge's support page lists one odd case: a rogue antivirus called Segurazo can make the Overwolf/CurseForge installer vanish. The suggested fix is downloading it again through your browser.
My rule of thumb, not CurseForge policy: if you upload the file to VirusTotal and one or two obscure engines complain while the big names are clean, and it's a well-known mod or the installer from curseforge.com, I'd lean false positive. If the file came from a DM, or lots of engines complain, delete it.
But don't read a clean scan as a guarantee either. CurseForge says fractureiser got past commercial antivirus. A scan is one input. Where the file came from matters just as much.
How to download safely
- Type curseforge.com yourself, or use the official app. Unofficial sites use similar names, and you can't tell from the name which ones are connected to CurseForge.
- Check the author. Is it a name you know, or someone with a long history of projects?
- Check download count, file date and comments. A popular mod with a recent file and normal comments is what you want. A brand-new project with a handful of downloads asking for trust isn't.
- Install through the app or a launcher instead of dragging random JARs around. The launcher roundup above covers what's out there.
- Never import a ZIP someone sends you on Discord or anywhere else.
- Stay out of cracked or pirated mod packs. No safe version of that exists.
- Ignore DMs from "staff". Overwolf and CurseForge staff say they never ask you for information in direct messages. Look for the Admin or Support tag, or open a ticket.
If you build modpacks for a server, how to make a modded Minecraft server walks through it. And for pack picks that are actually worth installing, try the best Minecraft modpacks or the best skyblock modpacks.
Is the CurseForge app legit? Do you need Overwolf?
It's legit in the sense that it's the official app from the company that owns the site. You don't need the Overwolf version, though. The standalone download exists, and CurseForge describes it as the lightweight option. If you just want to install mods, I'd start there.
"Legit" and "I like it" are different questions, which is what the complaints further down are about.
CurseForge vs Modrinth, briefly
Modrinth is the other big Minecraft mod host. Its code is public on GitHub, and its help center says moderators review submitted projects against its rules. CurseForge uses its own mix of automated checks and manual review. They work differently, but I wouldn't tell you one is more secure. The fractureiser investigation team said fractureiser wasn't a website-level problem and that "Modrinth is just as safe as CurseForge is." Whichever you use, the same habits apply.
Why are people against CurseForge?
It's mostly about Overwolf, not malware:
- The API change. In late 2021, Overwolf announced a new authenticated API and a per-project switch for third-party access. Mod developer asie wrote at the time that existing mods were opted in by default, new uploads were opted out, and that the setup would discourage competing software. His reading of why: downloads outside CurseForge's own ad-showing app don't earn authors rewards and cost bandwidth. Community reports from 2022 say that's when the restrictions hit third-party launchers and downloads broke for tools like MultiMC.
- The flip side. Asie also noted author payouts went up under Overwolf. CurseForge says it shares ad revenue with authors, so the same system that locks launchers in is what pays the people making mods.
- The app itself. People also complain about the ads, and some call the Overwolf software heavy. That's opinion. If it's your gripe, the standalone app and Premium are CurseForge's answers to it.
- Today's rules. The API terms say developers need their own API key, and Overwolf can ask for a licensing deal once an app passes a usage quota it sets itself.
None of that makes it a virus. It makes it a platform run by a company with its own business interests, like most platforms.
FAQ
Is CurseForge safe and legit?
The site and app are the official, Overwolf-owned mod host. Safe in practice means you download from curseforge.com or the app, and you don't sideload ZIPs from other people.
Are there virus mods on CurseForge?
There were in 2023, when fractureiser spread through hijacked author accounts. CurseForge says the infected files were removed, and the investigators say it's over. Moderation is described as "under our best efforts", so check authors and comments anyway.
Is CurseForge safe in 2026?
CurseForge's own May 2026 safety post says attacks aren't coming through CurseForge itself, but through impersonators sending fake modpacks. Stick to official downloads and you avoid most of it.
Is Overwolf safe?
It's the company that owns CurseForge, and it builds the CurseForge app. Complaints about it are mostly about ads and weight. If you'd rather skip it, the standalone app is there.