WeedHack Minecraft Malware Continues to Spread
Fake Minecraft sites rank at the top of Google search results, targeting unsuspecting users.
1WeedHack's Distribution Methods
WeedHack spreads through fake Minecraft client sites, YouTube videos, and SEO poisoning. According to McAfee's report, over 6,300 users attempted to access these sites in the past month. Attackers target users by ranking at the top of search results for popular Minecraft tools. The malware primarily spreads through platforms like Discord and MediaFire.
2Malware-as-a-Service Model
WeedHack is a Malware-as-a-Service operation active since January 2026. It offers two tiers: free and premium. The premium tier, priced at $5 per month, includes webcam surveillance. Operators can monitor stolen credentials in real-time and configure custom payloads. The operation adds 2,000-3,000 new victims daily.
3EtherHiding Technique
WeedHack uses a technique called EtherHiding, which fetches the attacker's active server address from the Ethereum blockchain. This ensures the malware remains functional even if individual servers are shut down. The malware steals session cookies, passwords, browser data, and cryptocurrency wallet contents.
4Details of Fake Sites
Fake sites replicate the features, FAQs, installation steps, and even GitHub repository links of genuine tools. McAfee notes that most of these sites appear legitimate, giving users little reason to suspect anything. For example, nova-client.com was created for a client that lacks a real website.
5SEO Poisoning and Search Results
Attackers manipulate Google search results for popular Minecraft clients. For instance, the top two results for 'Xenon Client' lead to fake sites distributing WeedHack. These sites offer installation guides, free and paid downloads, and links to the real Xenon Client GitHub repository. Users clicking the first result may unknowingly download malware.
6Weakness in Minecraft Mod Community
WeedHack exploits a structural weakness in the Minecraft mod community: many popular tools lack official websites, relying solely on GitHub pages and Discord servers. Attackers fill this gap by creating fake sites and ranking them above genuine GitHub repositories. For example, 22qq-client.com was created for a Crystal PVP mod.
7AI-Powered Fake Sites
One site in the WeedHack campaign was built using lovable.app, an AI-powered web application builder that generates working sites from natural language instructions. While the platform itself is legitimate, its use here is malicious. The accessibility of such tools has nearly eliminated the cost and skill required to create convincing fake gaming sites.
8Recommendations for Users
McAfee advises users to download mods and clients only from official developer repositories or trusted platforms like Modrinth and CurseForge. Any tool requesting antivirus deactivation should be treated as malware. Even trusted Minecraft communities can inadvertently spread scams, so caution is essential.
Original article: Security Affairs — WeedHack Minecraft Virüsü Yayılmaya Devam Ediyor