As many as 50,000 Minecraft players have been infected by malware that could delete the contents of their hard drive after downloading infected game skins from the official Minecraft store.

The malware, discovered by security firm Avast Software s.r.o., was delivered inside the PNG file that comes with skins, a way for players to change their character (pictured). In addition to reformatting hard drives, it can also delete backup data, remove system programs and send messages to an infected user.

“The malicious code is largely unimpressive and can be found on sites that provide step-by-step instructions on how to create viruses with Notepad,” Avast’s Alexej Savčin wrote. “While it is fair to assume that those responsible are not professional cybercriminals, the bigger concern is why the infected skins could be legitimately uploaded to the Minecraft website.”

Compounding the problem, because the infected skins were hosted on the official site, warnings that the download was infected by malware could possibly be ignored by users, particularly given many are children.

Minecraft is estimated to have 74 million users but most players use the default versions and do not download custom skins. “This explains the low registration of infections,” Savčin noted. “Over the course of 10 days, we’ve blocked 14,500 infection attempts. Despite the low number, the scope for escalation is high given the number of active players globally.”

Microsoft confirmed that the report was accurate, saying in a statement that it had “addressed the issue and put additional measures in place to protect our community,” while also encouraging users to report any suspicious activity to feedback.minecraft.net.

Minecraft’s developers, however, disputed some of the findings, writing in a blog post that while the skin PNG files did contain malicious code, “the code would not be run or read by the game itself.”

Avast, as a security company, naturally recommends that people use antivirus software such as their own, but the problem may also be one of education given that the biggest group of players are kids under the age of 15.

Image: Avast