What is this Minecraft "Gamble Rig" really doing?

A cybersecurity researcher analyzes 'Gamble Rig', a malicious Minecraft mod targeting Donut SMP players by falsely claiming to help cheat in server-side gambling. The mod is actually malware that installs RATs (Remote Access Trojans) including Weed Hack and Atom Rat, disables Windows Defender, steals credentials and Wi-Fi passwords, and establishes persistence via scheduled tasks. The analysis covers static analysis techniques including decompiling Java mods, decoding XOR-obfuscated strings to find C2 servers, and observing live malware behavior. The researcher notes increasing sophistication in Minecraft malware distribution — moving from obvious .exe files to convincing mod packages — and advises gamers to use isolated systems or VMs when installing untrusted mods.