2026 Cross-Site Scripting Attack
In April 2026, 
IconPippi performed a Cross-Site Scripting attack on MinecraftOnline Wiki using 
Darkphix wiki account.
With the intention of stealing user credentials and gaining access to the underlying Linux system.
The attack injected malicious JavaScript code on various pages with the use of CVE-2025-61638 vulnerability,
usage of this exploit was made possible by the server using an outdated version. At the time, MinecraftOnline used MediaWiki version 1.35.13,
this version hadn't been supported since 21 December 2023.
The exploit that was attempted to be used to gain remote code execution was CVE-2026-58025,
which at the time of attack was undisclosed vulnerability that affected all supported versions of MediaWiki.
The attack was discovered by 
bartek_kx on April 20th and reported to the admin team the same day.
While credential stealing attack was almost surely successful (and is treated as such),
there is no evidence that the conditions required to gain remote code execution were ever met.
History
Initially the attack was solely targeted at 
techkid6 and his user page with edits containing exploit being made on April 7th and on April 9th,
after someone unknowingly removed the exploit by editing the page.
On April 12th edit with the exploit was made to Template:Infobox expanding surface of the attack to all pages using this template.
In the period between that edit and discovery of the attack various players noticed small issues with MinecraftOnline's Wiki. Namely: visual editing not working, CustomCollapse templates defaulting to expanded, preview changes button behaving improperly and random small boxes appearing and disappearing on page loads
On April 20th bartek_kx visited MinecraftOnline Wiki and saw one of those random small boxes and decided to open browser dev tools
to see what they were. What was found was HTML element that had injected autofocus and onfocus attributes, which would fetch JavaScript payload from
attacker supplied URL and execute it, and by looking in network tab of browser dev tools it was found that the payload would send information
about the page being visited, ip address of the user visiting the page, their username (if they were logged in) and browser's user agent string,
and send to attacker controlled discord webhook. bartek_kx notified currently online admin about the attack shortly after.
After the initial report, edits containing XSS exploit were quickly reverted by Admins and discord announcement about the attack was made around 2 hours after the initial report. Later wiki page editing would be disabled, while the full extend of the attack was investigated and mitigated.
On April 21st follow-up discord announcement was made notifying players that the attack attempted to steal log in credentials, and advised people that logged into wiki in the past 8 days to reset their password
On April 22nd wiki page editing would be brought back after MediaWiki version was updated to 1.43.8 and after the XSS vulnerability was confirmed to be patched, ~75 players that used the wiki recently would also get their password reset, and important Template pages would now be protected.
Attack
Entry point of the attack was CVE-2025-61638 vulnerability that allowed attacker to inject arbitrary HTML attributes to selected HTML elements allowed inside of wikicode. The attributes that were injected were onfocus and autofocus attributes, autofocus attribute makes the element automatically in focus and onfocus attribute allows specifying JavaScript code to be run when the element is in focus, effectively allowing any supplied JavaScript code to be run instantaneously, resulting in vulnerability type that is commonly referred to as XSS (Cross-Site Scripting)
This vulnerability would be used to inject JavaScript code inside Template:Infobox, a template that is the most used template on MinecraftOnline Wiki. The code that was executed inside of this injection was a minimal code that only fetched file from URL and executed it.
This first payload wasn't the main part of the attack, but only small obfuscated JavaScript code that would remove the "small random box" which was HTML element used for injection, in order to avoid detection, then it would fetch and execute the second payload.
The second payload was also obfuscated and required tools to partially deobfuscate it for static analysis.
It contained code that would hijack navigation actions such as clicking on hyperlinks or refreshing page and would fake page transition by replacing
the current page contents with new one and changing URL in address bar using history.pushState method.
This was done so that the malicious JavaScript code would persist accross different pages, as normally going to a different page would unload any JavaScript that is currently running,
this way the malicious payload could modify behaviour of pages that normally wouldn't be possible to be inject into, like user login page.
The payload would detect when user is trying to log in and send log in credentials through a discord webhook, it would also detect any page user visited and send info about
that through the same webhook along with ip address, username (if user was logged in) and browser's user agent string. To avoid detection the payload would remove any sight of
XSS from all visited pages, making it difficult to spot it by just checking wiki source or page history.
There was also "Self-Preservation" code that appended XSS to Template:Infobox page when edited,
this "feature" was likely added after edit to techkid6 page on April 9th removed the XSS.
Arguably the most interesting part of that payload was the part that fetched stage 3 payload and executed it; if user was logged in,
it would calculate hash value using SHA-256 function by taking user name, user id, user groups and user registration timestamp,
this hash value would effectively be random but always the same for a given user,
then it would fetch file that is named using that hash value from attacker controlled bucket and execute it.
This was likely done to defer reverse-engineering, but would prove to be completely useless as the service that was used for hosting it allowed viewing whole contents of a bucket.
Additionally generating hash values for all wiki users and comparing them with the ones hosted in the bucket revealed that the stage 3 payload was
directly targeted at 
SlowRiot, techkid6 and 
14mRh4X0r the only admins with sysop user group.
Stage 3 payload contained obfuscated code that would exploit CVE-2026-58025 vulnerability to gain remote code execution through the use of unsafe deserialization. Prerequisite of this exploit is importupload right that only members of sysop group have by default.
SlowRiot, techkid6 and 14mRh4X0r would also get contacted on discord
with fake screenshots of their wiki pages being vandalised in order to get them to trigger the remote code execution exploit,
however upon visiting those pages they wouldn't find them vandalized, thus not logging into wiki and not triggering the exploit.
See Also
- 2022-23 Gradle Backdoor Attack - a successful backdooring of the server.
References
- MediaWiki wiki contributors, 2026, 'MediaWiki 1.35', [1].
- MinecraftOnline admins, 20-21 April 2026, official announcements regarding the attack, MinecraftOnline.com discord, [2].
Crafter_Keegan, 15 April 2026, listing issues with MCO Wiki, [3].