A trusted or compromised account starts casual conversation before asking the victim to join or test a Minecraft server for a friend's birthday.
Observed social-engineering pattern where a legitimate friend account may already be compromised and is then used to persuade trusted contacts to test a Minecraft server or modpack. Treat unexpected downloads, modpacks and executables as suspicious.
Initial Threat Registry baseline intelligence record.
Add evidence, indicators or new activity directly to TR-2026-0001. It will enter analyst review as unconfirmed intelligence.