We’ve encouraged our children to think about security from the beginning. One of our kids knows the rules about strangers online, and he takes his accounts seriously: two-factor authentication and passkeys on everything that offers them, usually strong instincts for when to check stuff with us.

Recently he installed a Minecraft mod called FakeBalance anyway. It arrived in a Discord message from a stranger on a server he plays on, and it looked like a harmless add-on.

It wasn’t. Every time he joined the server, the mod checked his in-game balance and paid everything over $500 to another player. The money went.

Why it worked

None of that security helped, because nothing was broken into. He ran the mod himself, inside a game he was already signed in to. Two-factor and passkeys protect the front door. They can’t stop something you’ve invited in.

The offer was simply good enough to get past rules he knew well. Businesses see the same gap after every round of security awareness training. Knowing a rule isn’t the same as following it when the bait looks right.

It’s not rare, and it’s organised

Our mod only stole game money. Others are built to take far more. Earlier this year, a Minecraft server sold itself as a cosy, safe community. Players joined through Discord and had to install its modpack, which hid a password stealer. A malware kit called WeedHack, spread through fake Minecraft cheat mods, has infected more than 116,000 computers since January, according to McAfee research. Criminals rent it for $5 a month.

Scammers hijack Discord accounts and message the victim’s friends: “can you try my game?” As Malwarebytes puts it: “Remember, their current account may have been compromised.”

Why a business owner should care

Password stealers take saved passwords, browser cookies and login sessions. A stolen session is what keeps someone signed in, so it can open Microsoft 365, Xero or a VPN without the password. This isn’t theoretical. In the 2024 Snowflake breaches, Mandiant found the stolen logins often started on contractors’ computers that were also used for gaming and pirated software. Around 165 organisations were notified. Verizon’s 2025 breach report found 46% of systems with corporate logins in stolen data were unmanaged personal devices. And late last year, the NCSC emailed around 26,000 New Zealanders whose devices were infected with one stealer.

Every step from a child’s download to a business account is documented. The family PC is, in effect, one of your suppliers.

What we suggest

At home:

  • Give children a standard account, not an administrator one.
  • Install games and mods from official sources only, and never turn off security software to make one work.
  • Make it safe to own up. Speed is what limits the damage.

Netsafe can help: 0508 638 723, or text “Netsafe” to 4282.

At work:

  • Work devices for work only. No family use, and no personal browser profiles.
  • Use MFA and conditional access, and treat a stealer alert as a reason to end active sessions, not just change passwords.
  • Put home and guest devices on a separate Wi-Fi network.
  • Thank people for reporting mistakes. Hidden ones cost more.

Trust first. Compromise second. It’s the same attack whether the target is a Minecraft balance or your company’s email.

If you’d like a second opinion on how your team’s home and work devices overlap, call us on 09 579 5432 or email support@anvil.net.nz.