Loading story…
Malicious websites impersonating Minecraft clients, mods, and related tools are continuing to distribute the WeedHack malware family despite prior command-and-control disruption. McAfee Labs identified at least 10 active sites and multiple file-hosting accounts tied to the campaign, while McAfee WebAdvisor blocked more than 6,300 attempts to reach them in the past month. The lures are amplified through SEO poisoning, YouTube links, Discord, GitHub repositories, and trusted Minecraft community platforms, with attackers using convincing lookalike pages to trick gamers into downloading malicious files.
The infection chain delivers Java JAR payloads that collect system information, add Microsoft Defender exclusions, and steal credentials, browser data, cookies, and cryptocurrency wallets from infected hosts. Earlier reporting linked the Malware-as-a-Service operation to at least 116,464 infected systems and 2,000 to 3,000 new victims per day, while researchers said the operators used EtherHiding to retrieve active server addresses from the Ethereum blockchain and keep the campaign resilient after takedowns. One spoofed site was reportedly built with the AI website builder Lovable, underscoring how easily attackers can create realistic malware-delivery infrastructure.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
McAfee detailed an ongoing SEO-poisoning campaign in which fake sites impersonating Minecraft clients such as Xenon Client, Glazed Client, Radium Client, SeedCrackerX, Nova Client, Meteor Client, 22qq-client, and Krypton Client distributed WeedHack malware. The report also identified specific malicious domains, GitHub repositories, Discord channels, and file-hosting services used to deliver infected downloads after the original C2 dashboard was disrupted.
In June 2026, Check Point reported a large-scale SEO poisoning operation impersonating open-source and freeware projects that delivered malware including Remus Stealer, AnimateClipper, and SessionGate. The WeedHack reporting compared the Minecraft-focused campaign to this broader activity.
McAfee researcher Aayush Tyagi first documented WeedHack in early June 2026. Earlier McAfee reporting tied the campaign to 116,464 infected systems and growth of 2,000 to 3,000 new victims per day.
McAfee's follow-up reporting said the WeedHack Malware-as-a-Service infostealer operation had reportedly been running since January 2026, targeting Minecraft players through malicious distribution channels.
In a follow-up report, McAfee documented ten active malicious websites and multiple file-hosting accounts still distributing WeedHack despite the C2 disruption. McAfee WebAdvisor blocked more than 6,300 attempts to reach the malicious sites over the past month.
McAfee said WeedHack's command-and-control server was no longer active after publication of its original article, indicating the campaign's C2 infrastructure had been taken down or otherwise disrupted.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceinfosecurity-magazine.com
Open sourcemkd-cirt.mk
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourcethehackernews.com
Open sourcemcafee.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
McAfee researchers reported that the **WeedHack** malware-as-a-service operation has infected more than **116,000 systems** by targeting Minecraft players with trojanized mods, clients, cheats, and utilities. The campaign has been active since at least January and is spreading through **YouTube videos**, gaming forums, and **SEO-poisoned** websites that mimic legitimate mod-download pages, often borrowing trust signals such as links to real GitHub repositories and Discord servers. Researchers tracked more than **3,820 malicious JAR files**, over **240 distribution URLs**, and infection volumes of roughly **2,000 to 3,000 systems per day**, with the largest victim concentrations in the **United States, Germany, India, and the UK**. WeedHack is operating openly on the clear web with a free dashboard for viewing stolen data and building payloads, while a premium tier priced at about **$5 per month** adds remote-access and surveillance features. The malware steals **Minecraft session IDs**, browser cookies and passwords, cryptocurrency wallet data, and credentials for services including **Discord, Steam, and Telegram**; paid users can also gain **webcam access, keylogging, reverse shell, screen sharing, and file-management** capabilities. McAfee said the Java-based, multi-stage malware uses **Ethereum-based C2 discovery**, persistence, and Windows Defender evasion, and observed that many customers in its 800-plus-member Telegram community appear to be teenagers or young adults using the service for account theft, harassment, cyberbullying, and webcam spying.
Jun 29, 2026
The Brazilian cybercrime group **LofyGang** has resurfaced after more than three years with a malware campaign aimed at Minecraft players, distributing a new infostealer known as **LofyStealer** or **GrabBot** through a fake cheat tool called **"Slinky."** Researchers linked the activity to LofyGang through code artifacts, infrastructure, and command-and-control branding, and said the lure uses the official Minecraft icon and social engineering to trick users into launching the malware. The campaign reflects a shift from the group’s earlier npm typosquatting and software supply-chain activity toward a broader **malware-as-a-service** operation. The infection chain uses a JavaScript or Node.js-based loader to deploy a native payload in memory as `chromelevator.exe`, where it injects into live browser processes to evade conventional antivirus and EDR visibility. The stealer targets at least eight major browsers and harvests cookies, passwords, session tokens, payment card data, and IBANs before compressing and exfiltrating the data to **`24.152.36.241:8080`**. Researchers said the operation includes **Free** and **Premium** tiers, a victim dashboard, and a custom builder called **Slinky Cracked**, while also highlighting the wider abuse of trusted platforms such as GitHub, Reddit, and search results to spread malware through fake repositories, bogus alerts, and gaming-cheat lures.
Jun 29, 2026
Researchers reported a large-scale **malware distribution campaign** that used fake software offerings hosted on trusted platforms to infect users, with operators increasingly relying on **AI-assisted or “vibe-coded” development** to scale payload creation. McAfee identified more than **443 malicious ZIP archives** masquerading as AI tools, game cheats, VPNs, drivers, and decryptors, distributed via services including *Discord*, *SourceForge*, *FOSSHub*, *MediaFire*, and *mydofiles.com*. The campaign used **48 variants** of `WinUpdateHelper.dll` across **17 kill chains**, each with separate command-and-control infrastructure but linked through shared cryptocurrency wallet credentials, allowing researchers to trace monetization activity and victim distribution across countries including the US, UK, India, Brazil, France, Canada, and Australia. A separate but related report described another **multi-stage malware campaign** that also relied on deceptive delivery and evasion, using **.NET Ahead-of-Time (AOT) compilation** to hinder analysis and a host-scoring system to avoid sandboxes and low-value targets. In that intrusion chain, a phishing-delivered ZIP launched `KeyAuth.exe`, which fetched `bound_build.exe` and then deployed both the **Rhadamanthys infostealer** and an **XMRig** miner disguised as *MicrosoftEdgeUpdater*. The malware checked conditions such as RAM, uptime, document count, and active antivirus processes, and terminated itself if the environment scored below a threshold, showing a deliberate effort to evade detection while maximizing successful infections.
Jun 29, 2026