Eaglercraft functions by translating Minecraft's Java code into JavaScript, allowing it to run in a browser's JavaScript engine. Hacked clients exploit this by modifying the client-side code that the browser executes.
The most critical risk involves malware. Security researchers have discovered that fake versions of Eaglercraft offline installers, specifically "Eaglercraft 1.12 Offline," are being used to distribute a dangerous remote access trojan (RAT) called NjRat . 1.8.8 Hacked Client Eaglercraft