Investigating Minecraft's Sneaky Rat Mod Scam

In this video we investigate the rat mod scams (keylogging scams) in hypixel skyblock!
I understand this is an older topic but I had interviewed a couple of people and wanted to make it into a video. Stay safe!
Timestamps:
Victim's perspective: 0:00
Interview with an ex-scammer: 2:22
Interview with victim: 4:13
Back to the scammer interview: 5:26
A few things I wanted to mention:
-Snow has stopped scamming for around 10-11 months now.
-These scams have generally become less used simply due to people becoming more aware.
-Rat mods can come in many different forms, only download mods that are reputable and from the official websites.
-Check website URLs before giving sensitive information, they could be fake and not secure.
Discord Server: / discord
Game: Minecraft Hypixel Skyblock
Server IP: mc.hypixel.net
Tags (ignore): Minecraft hypixel skyblock, skyblock hypixel, cekofari scammer, Minecraft scam, rat mod scam, keylogging scam, session ID scam, hypixel scammers, scammer gets scammed, interview, documentary.

[@speedshadow7728]

I'd say if you fall for one of these, its your fault. It's still a really fucked up thing to do

[@zacfr]

ez coins

[@robertmisztal3692]

@zacxlw ez ban for you

[@zacfr]

@@robertmisztal3692 bro it was a joke lmao

[@leschatssuperstars1741]

true

[@CurtisLee2009]

@@robertmisztal3692 you cant get banned

[@thunderkojote7746]

I just feel bad for the people who fall for scams like these, since its mostly kids/younger people who don't know better

[@joel9002]

@@Jasprr3 L

[@Bupps31]

same i lost a 2000 hour bedwars account i was crying for days nonstop

[@Jammin591]

yeah I lost all of my stuff since I didnt know any better. Generally I was new so that just made it worse.

[@Wqsc]

I did

[@Fresh_Air_9]

yep I lost 200 hours of skyblock

[@smaster9758]

I feel for that 2nd victim, basically the same thing happened to me. Played every day with someone I thought was my friend for 8 months and then they took everything. Lost about 2b and 750 hours. People suck

[@walid8600]

Same Thing Happend

[@Cottongorillatag]

AlL mA fRiEnDs ArE tOxIc A-

[@user-ln1lt7mr9z]

same

[@user-pr3ed1tt5t]

Same bruh you are rly same as my case

[@Pyr0t3chn1c]

same thing here but they took my minecraft account and im to poor to buy a new one ;/

[@Mitblade]

Yk what ticks me off the most, it’s these hackers taking the coins what is wrong but what hurts is them deleting your profile, skills, guilds friendlist etc, and getting you banned, just why? like bruh just take the coins and make bank.

[@NoNNNNN]

Honestly the ratter being 14 amazes me. That means his friends were likely around the same age gap and they managed to most likely make a rat mod. Amazes me at the ingenuity of some people. Or his friends could have stolen the mod from someone else but i still find it fascinating how these work.

[@Hublom_]

I think the ratter was joking about being 14 he is not 14.

[@13XDyt]

⁠@@Hublom_no people do this kinda stuff at 14 he’s using a voice changer rn

[@bobbrown839]

he was 100% lying about being 14 lmfao

[@JustSenix]

Bro ima be honest i learned how to Steal cookies/keys when i was 11 This guy is not anything special i can tell you that

[@NoNNNNN]

@@JustSenix thanks for the necro post flex man

[@limelite5006]

As a wise man once said, “It is never the victims fault, but maybe they didn’t make the best decision that day…”

[@miner_farm]

@@joe5706 ah yes, if i randomly shoot someone in the street it is that random persons fault fr ong!!!

[@miner_farm]

@@joe5706 "its always the victims fault" there is a victim in both cases, im saying its not at all always the victims fault, and online it still isnt always the victims fault. What if the hacker gets lucky and guesses stuff or what if their family doxxes them.

[@moazcheese5126]

@@joe5706 my guy what the fuck how is it the victim's fault??? Especially if its someone's friend who gave them a mod

[@Lugtastic]

@@miner_farm Still the victims fault lmao, I've been downloading cracks and hacks for years never been compromised. Be smart, don't be dumb.

[@miner_farm]

@@joe5706 is that a threat

[@nilampandey2508]

"This dude that I thought was my friend." Mans really got betrayed.

[@rtzgf67games7]

A RAT is a remote access trojan. I think the actual mod here is a token grabber. RATs are viruses that typically establish some sort of connection (most likely a reverse shell), that gives full access to the victims computer. I would say the mod is not a RAT because RATs (if they aren't obfuscated or encoded) get detected by windows defender. Correct me if I'm wrong lmao

[@hrkip]

Base64 :skull:

[@icudill4017]

Yes you are correct; but you did say something wrong here; A RAT isnt a "RAT" because it gets detected by windows defender it is classified by when a third party gets full control access to your Operating System without your permission or knowledge, for malicious intent.

[@hrkip]

@@icudill4017 base64 skul

[@rtzgf67games7]

@@icudill4017 I didn't say a RAT is a RAT because it gets detected by the win defender. All I said is that I don't think the mod in question is a RAT, because I don't think they would obfuscate or encode it. Prob should have been more clear lmao

[@LiEnby]

it gives you full access to your minecraft acccount, i .. guess?

[@crafterboy27]

Fun fact: you can convert jar files to zips which you can decompress and look at the files. If they didn't make it so obvious you may need some Java knowledge to figure out what something is doing. I think you can all use some IDEs to remove anything that shouldn't be there like loggers and string decoders(decoders can decoders encoded code and then run that code in some way.)

[@VintageToiletsRock]

You are right, but checking the jar's hash would have been a much easier first step that a 12 year old could actually do.

[@majanito1]

I dont think you did enough research on session ids 1. Mojang obviously doesnt give your session id to the server you are playing on, as if it was like that you could rat someone by just getting them to join your minecraft server 2. Yes, login in and out of your account generates a new session id, but it doesnt invalidate the old one. The ratter always has access to your account for 24h

[@Pinnae]

if u login on lunar that resets ur session id

[@maumau4369]

I guess the only way to now Safe your Account is disable the online player thing in your Xbox account so he can’t join multi player servers

[@zacfr]

@@Pinnae nope the victims are on forge

[@Pinnae]

@@zacfr yeah but if u login on lunar from usually playing on forge, it resets your session id which blocks the ratter from accessing your account

[@zacfr]

@@Pinnae yeah but the victim is too in-shock to know what to do. I'm a ratter, I know

[@quippic8]

I was ratted when I had full necron. It is a shame what people will do for fake coins for a fake economy.

[@boostblock6]

dude. the guy made thousands of real life dollars from this. it's past the fake economy.

[@dumby2175]

Yeah, I got ratted twice. After that, I made sure to soulbind every single item I get. If I didn't do that, my current net worth would probably sit around 400m instead of the current 2.7b

[@itzzahmola1373]

This is What Happend With Me And I Got Banned Too Also Now My Appeal Got Accepted .... I Will Be Banned In 2 Days .. Soo Be Careful ❤️

[@TasinTheLegend]

You Will Be Banned Or Unbanned In 2 Days???

[@therealblobfish]

I got security banned because I reported my account so they couldn’t do any more They only allow you one appeal for security stuff

[@holysmith7117]

@@therealblobfish how to security ban your account

[@Mitblade]

@@holysmith7117 yeah how lol

[@TheFlyingGoink]

I got ratted as well

[@Jammin591]

That is how I lost everything. I was down bad since I had gotten scammed for my armor and(16mil) a couple of days prior and thought I would get my money back. Little did I know it was a mod that would let them log into my account and steal everything. I also got banned after they were done with it and that is how I stopped playing Minecraft. I was new too, so I was not motivated to gain it back as I had been getting unlucky constantly for 2 weeks. Edit: The scam contained some similar file and the person who scammed was someone I was friendly with in the game.

[@janx7033]

For clarification: It is NOT possible to remove your old session id by generating a new one. Mojang will generate a new Session Id but your old one will still be valid. Most of the time a id will stay valid for around 24h. The ONLY way to protect yourself if you noticed that you were hacked is to log on hypixel with a fast auto reconnect mod and the try to get yourself security banned on the forums. If you havent been banned before it is also possible to just watchdog ban yourself by flying in the lobby with a cheat client or something like that (You will be banned for 30 days but you skyblock island will be save) Edit: If you download a mod from any source ALWAYS decompile it and search for the following piece of code: "Mineccraft.func_71410_x().func_110432_I()". This is a direct access to the Minecraft session and you should trust no mod that needs access to this. If the code of the mod is unreadable then its probably hidden by the creators and you should also dont use it exept if you downloaded it from a trusted first party like sbe.

[@toggledclient_1509]

Thanks for the reply and making it detailed such as the code loggers and just one more thing how do u decompile it? Anyways thanks for the detailed response stay safe!

[@Diynn]

Can't you technically hide it from being seen using this method by utilizing Java's reflection?

[@flameninja5016]

btw u shouldnt have the code in here now people can easyer become ratters

[@wet_buff4032]

please also do not fall for the discord server rat. it is a rat in which a bot or real account goes to a big server and dms you a server link with a few thousand players in it. the server rats you through verification through your microsoft account. (this rat is found in lfgs and sometimes hypixel skyblock chat with a big giveaway where they give you the server link and lure you into it)

[@the.real.fan.]

Hey Ceko glad to have done the part of the victim at 0:56 (día con and young drag) got paid 500k to do this ty ceko

[@abnature]

got ratted via microsoft verification end they deleted all profiles

[@overskirt]

imagine getting oauthed LOL

[@ItIsJan]

if you get oauthed, the first thing you should do is get the irst hackclient you can (sigma) and hop into a skywars game and just start killaura-ing, itll get you banned for 30 days, enough time to get them out of your account

[@jaxorgate]

@@ItIsJan w strat

[@dhruvjn32]

Something like this happened to me a while back. I was looking for a mod to get the melody talisman, and I ended up downloading it. One of the worst decisions of my life. This was about when I was just getting into skyblock, and started making money through corrupt soil, and I had made 75 to 80m. The roughly 2 hours later, its all gone. However, this does end well. Since I was flipping corrupt soil, I needed enchanted mycelium, and had decided to make a gamble on it. I bought it when it was about 8k per piece, and though, "Wow, this is still going up, I should buy right now, and sell it at about 13k." Bought a double chest of this, and the hacker never took it. It was labeled as well. The next day, the price dropped to around 5k, and although I had made a loss, I could make back some money, and continue flipping from there. I am now better then before, and have Networth of 500m. Nearly quit though.

[@rpe]

Thanks for the idea!

[@feuerrobin4269]

the story you sayed in the beginning felt like you were almoast telling the story on how i got scammed

[@Flamingghost1025]

Ratters are kinda entertaining. I know how to code/read code and its just kinda fun to mess with them

[@LiEnby]

'my friend managed to crack skyblock extras' *proceeds to explain something that is not cracking*

[@DaWhaleClips]

Even if you log off and on Minecraft they have a way to generate a new session id. you need to disconnect their app from Microsoft account

[@coronacrazy7705]

this sounds like the type of thing schools would make you watch for "safety"

[@realpencat]

I'm not even kidding, literally this happened to me; from start to end

[@iwantminecraft]

6:20 Hey, that blur is kinda sus!

[@flipflop2256]

i once got ratted on a profile where i had a 2.2b coin networth and 1900 hours of playtime just because i downloaded a mod to help with melody's hair

[@Etheriall860]

You can go into microsoft settings and turn on that you cant log in from other locations

[@ASuspiciousFox8242]

I've fallen victim to this exact strategy. Afterwards, my friend tracked his IP adress and I called the FBI on him (yeah I know, overkill) since it was technically illegal. Afterwards, I got the same friend to give me some of his spare things like full necron + a livid so i was pretty happy that even though I lost over 3B, I still got some return and revenge

[@solar1076]

I feel bad for people that fall for it I personally bought it myself and it’s a great mod but people that can’t afford it fall for stupid scams like that

[@VulcanizedHCF]

lolitsalex back in the HCF days used to say “RAT TROJAN JAVA DRIVE BY!

[@adon155]

u should also mention these mods can be much, much worse than just stealing skyblock coins, ie stealing all saved browser passwords, discord tokens, etc

[@rade_]

exactly

[@FlorianWendelborn]

6:10 "I can get myself set-up for life" with 5k lmao

[@Yaboi-od4vb]

Investigating cekofari's upload schedule

[@FlorianWendelborn]

5:00 pretty sure this is wrong. Session IDs are valid for 24h, no matter what

[@Regocike]

Getting ratted was one of the worst moments of my life but in the long term it was worth it. I used to have 2b nw and was getting bored of the game already and after the rat and the 1 month ban i started an ironman and got to level 153 and 1b nw in arround 800 hours of playtime. Also the guy who ratted me got wiped so huge W

[@13XDyt]

Ur life? Video game progress? Bro its not that bad trust me when you look back in like 20 years

[@pj_supereme]

Are you playing on the same Microsoft account? (Ik it's late but plz reply i also got ratted)

[@godlessnoob]

YAAAY NEW VIDEO

[@bimladevi6101]

This is what happened to me he took all items and money and delted the profile too

[@wll678]

Ceko there is a new rat with discord servers linking to minecraft this rat generates a REFRESH session id which won't reset most of the time even if you change your passcode some times the ratter can still acess your account after loging in and out and is very difficult to do anything against

[@loosfer551]

I just got ratted and honestly kinda sad I didn’t have anything good I had like full SA and like a maxed livid dagger as my most expensive items but I worked a lot to get that stuff and I was just disappointed

[@liamr3866]

There’s a discord verification rat going around it takes u to Microsoft and u put ur details in and they get ur account I fell for this as well as some other people it sucked

[@WalkingBrainTheMathNerd]

Does it work the same when verifying an app?

[@Third7Plays]

4:33 I heard this kids voice and my heart dropped. This is a young child! At most maybe 14. Wow.

[@offensing5443]

tips, if u have to download a mod through discord dms or hypixel chat then its a rat

[@Mario583a]

Little did we know, Little Timmy was Cekofari.

[@lolabpro5458]

Some guy tried this on me but I watched this vid before so this vid saved me

[@Morri7_]

Kinda sad how only kids actually fall for these scams and that these scammers know it, and target kids. Rip their stuff

[@maestrotim5986]

not only kids lol

[@idiotically-everything]

See, this is why I am very suspicious of any files or links sent to me. You never run anything unless you're 100% it is safe

[@notnooby2118]

Dang this happened to me luckily I wasn’t to far in the game and only lost around 3 mil still left me depressed

[@leamissyoy]

I remember a game i played on long time ago and there is a forum of the game making bots but they were safe but a guy make a software that do not intend to be use in the game at all, just a random stuff in the general topic, i tested it few sec, and put in the trash, i log on my game the evening and log off, few hours later go back in the game and all my character inventory was empty. The guy used a random software to put a keylogger in. Idk for java, but do't trust even resourcepack, maybe someone can put a keylogger in or in a datapack, idk... even a random thing in a minecraft forum that's not related to mods at all. I have had 3 high level accounts on, only one get hacked, i changed password in the second i saw that someone was log on my account, and lucky i was, i played alays my 3 characters at the same time but i logged on only one this evening. It's not Wow, it's another game Dofus. Played on since 2007 and get the account hacked in 2014, lucky too that it waasn't the main character, but a support for combats. Back in the day i played a lot of game online with multi accounts. For minecraft the forum blackmarket could even load hack mods... On think it's cool to get paid plugins for free but...

[@kijanax]

6k set up for life? xd

[@JustSenix]

bro said setup for life with 6 grand when you know damn well he spent all of it already☠

[@Hxltby]

I almost got ratted, got my account back and had all my most expensive armour and weapons in my Inc. but they didn’t get anything

[@_wilbo]

I think someone is trying to do this to me rn I haven’t downloaded anything yet which is good. thank for this video I now know not to fall for anything like this but I did vc with him and he seemed so genuine and he was quit nice but thanks again:)))

[@forkisuk5099]

Idk how bcs I have no wired mods or anything similar but recently I was not in my coop and when I salvaged items on my brothers acc like half my net worth was missing (500m) and I’m trying to get it back lost like 800-900hrs of progress

[@ksodp800]

waltuh moment

[@joziahelliott1976]

Is there a way to check that they no longer have access

[@magyarhacking]

5:10 restarting the game is enough my guy

[@icudill4017]

No sadly; the session id will still be valid for 24 hours; and they will still have access to your account for that duration; the best way is to purposely get yourself banned by either security or cheating purposely

[@bash8692]

dude i got ratted yesterday. 750 hours down the drain, i was trying to find a party to play dungeons with and i found a stacked party and they told me to join discord vc and i had to verify my account. I clicked the button and got disconnected a few minutes after, logged back on and my 120m inventory, 30m purse, 18k bits were gone. Im so pissed and the ratter was trying to get me to pay 50 bucks for it back

[@iljuzazhamburgir3688]

Watching this as my items gettin sold on ah while im off

[@gdsnowmeows3342]

2:25 I've been framed! Funny coincidence

[@wallibears]

WHY DID I SEE THIS AFTER I GOT SCAMED

[@dAni-ik1hv]

i soulbind all my expensive stuff to piss them off

[@janisl2486]

If there's sheep there will be Shepards

[@commandcracker42]

2:39 This is not a SessionID its an UUID in hex format ._.

[@davidpena8470]

lost 1200 hours on sb

[@maxw912]

Skill issue

[@caosking7869]

i got rattet too but the reason was a hacked skyclient update

[@abababab-if9wz]

token logging at 14 is crazyyy

[@wkj]

Good explain

[@Andre-eo9ww]

nah why do i feel so bad for the kid

[@kingklumbea9836]

ye i once got ratted but litterly as soon as i realised i instintly went back to grinding and like 2 3 weeks and i was back like nothing happned

[@carrotahh]

i got ratted once and ratter was nice enough to tell me how to reset my session id lol

[@matawa9591]

R.I.P timmy123 😭

[@jutonix4935]

I need some help recently a guy invited me to his f7 perm. Because he was pretty good and had 7 bil networth i said yes. After that he got me on his discord server but there i hat to verify on Microsoft. I didnt really think much about it and agreed. 5 min later my Microsoft emailed me that a program had acces to it. Now im banned on hypixel and the guy ignored me on disord. Do I have to change Microsoft password or mojang or both??? Please help

[@CoLeCpvp]

First you make a unban appeal so that you get hypixel back then he has access to ur Account for 24 hrs try changing pass but they have ur session id

[@jacobdennison968]

This is similar to what happened to me. Discord verification rat. So first off you need to secure and un-rat your Microsoft account. If you go onto Microsoft’s website, log into your account, go to privacy, and check app access. You should see something in there that has permissions to access your data (for example, in my case, it was called hypixel verify). This is a rat token. So make sure you disable permissions for this application, and Then delete it. THEN change your password, and enable 2-factor authentication (hooking it up to your email or phone number is a pretty safe bet, then you will be sent a code every time anyone tries to log into your account). Then you will need to submit a ban appeal on forums and once you’re unbanned you should be safe to play again. Hope this helps.

[@jutonix4935]

Thank you so much for help

[@jacobdennison968]

@@jutonix4935 no worries I hope it helps. That process seemed to do the trick for me!

[@jutonix4935]

I just got unbanned but the dude deleted my account. RIP 1500 hours playtime

[@br00ddyan22]

this is why i coop soulbind everything i have

[@yumyumcarrots]

my friend on skyblock i trusted gave me one of these downloads and now i have nothing smh

[@holysmith7117]

if you put the mod in your mod folder and u delete the mod a minute after would it still hack me? i downloaded this mushroom internal mod apparently and i believe it is a rat mod ive runned minecraft with it

[@fahrenheitpg3d407]

if u download the mod ur ratted bro

[@holysmith7117]

@@fahrenheitpg3d407 the mod was 7 months old and nothing happened on my skyblock so far

[@fahrenheitpg3d407]

@@holysmith7117 well then it wasnt a rat and u got lucky i dunno

[@holysmith7117]

@@fahrenheitpg3d407 can they still rat me now?

[@fahrenheitpg3d407]

@@holysmith7117 they might have ur account info, or the rat doesnt exist

[@Theboss88166]

I think they should click the mod file and see if it's a rat mod

[@akgames9300]

what mods do ypou use

[@moonberryandbeezee]

i got scammed also but seemed like the ratter was in a hurry i kept like 200m worth of progress

[@assafglass]

I got scammed from them at my old minecraft skyblock accoumt they deleted it afterwards

[@walid8600]

I fall for one of these,that 2nd victim, basically the same thing happened to me. Played every day with someone I thought was my friend for 8 months and then they took everything ); I fucked Up 😢😮‍💨😭

[@ItIsJan]

the explanation of session id's is kinda wrong its more like mojang gives you your session id you tell mojng you jion a server and give mojang your session id you ask the sevrer to join the server asks mojang "ey jo did that guy give you a correct session id?" if mojang says yes they let them join, if not they dont

[@adamcorv]

A mod costing money that gives you an advantage over other players is literally a recipe for disaster it’s perfectly fine to monetize your mods like having donation links and others but there’s other mods that you can use like 7 different mods and you have like almost everything of SBE for free just not really worth it yknow

[@Thomasvanvreugde]

Rip them

[@theflyingsweat4031]

The thing is for me the samething happened but my friend got scammed by the same person and he told me to login again and change my password just in case and luckily I didnt lost anything tho i did get scammed 40m again yesterday :/

[@EasyMinecraft]

I lost my entire account due to a scammer...it sucks

[@MikoyanAndGurevichAircraft]

I’ve been ragged before it sucks

[@ari_archer]

this man calling the mod 'RAT mod' and 'keylogger mod' at the same time just shows the qualifications of this person to talk about such topics 👍👍👍👍👍👍

[@ell.....]

🤓🤓🤓

[@ari_archer]

@@ell..... ok

[@iamdanoob9400]

@@ari_archer 🤓🤓🤓

[@ari_archer]

@@iamdanoob9400 name checks out

[@lourencomatias9358]

🤓🤓🤓😂

[@Luke.uploads]

nah bro when i got ratted he deleted the whole profile

[@protyper9861]

The screen shot at the end bruh was asking for it how u going be worth billions and fall for scam like just a sign u shouldn’t be playing anymore buddies brain melted from the thousands of skyblock hours he put in

[@lilgamer5339]

just fell for this dude, he just did it to me rip my hyperion

[@easonlol9410]

thanks!!! i love you i think it has work now and i was silly but i'm happy i didn't got damage bc i got banned 180days lol and the hacker changed my name zombieontop6

[@telefonasson836]

i had like 600 hours on skyblock and someone aksed me if i wanted a free dungeons room mod and at that time i didnt know that it was a rat i downloaded the mod put it in my mods folder it didnt work and then i just logged off for the day and then the other day i log on and i dont have any of my coins and any of my items i lot 600hours of work and like 50mil coins

[@scruffytoast9366]

this has happened to me but they never took my items

[@icudill4017]

maybe because they used it to spam in chat to promote the mod more and didnt find any value of your items

[@milkey6000]

Nice bro

[@GnarIyHuII]

5-6 racks? I know what im doing from now on

[@ForikiTheRat]

skid kid only stealing ssid such a 2021 move

[@mikee.]

lmao let me guess: you're stealing ms accounts?

[@theflyingsweat4031]

Also can you do the same type of person But he keeps writing this message. If you are stuck in skyblock you can have my stuff (around 16b) Term hyperion /p me

[@theflyingsweat4031]

Also I got scammed by him but luckily deleated the mod before he could get on and I change my ID

[@filipetrujeira3359]

​@@theflyingsweat4031 If you ran it or launched MC with it you're screwed, a lot of malware spreads itself onto other locations of your PC and even infects other files in your PC with it's own code.

[@lesliejimenez729]

Good think I didn’t download this rat mod. For real.