Full Report
A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January. [...]
Analysis Summary
# Incident Report: WeedHack Malware Campaign
## Executive Summary
The WeedHack malware-as-a-service (MaaS) campaign has successfully infected over 116,000 systems globally by distributing malicious Minecraft mods and utilities. The infostealer targets a wide range of sensitive data, including browser credentials, cryptocurrency wallets, and Minecraft session IDs, utilizing social engineering via YouTube and SEO poisoning to lure victims. The operation remains highly active, averaging 2,500 new infections daily.
## Incident Details
- **Discovery Date:** June 2, 2026 (Reported by McAfee)
- **Incident Date:** January 2026 – Ongoing
- **Affected Organization:** Global Minecraft player community
- **Sector:** Gaming / Consumer
- **Geography:** Global (Primary impact: USA, Germany, India, UK)
## Timeline of Events
### Initial Access
- **Date/Time:** Commencing January 2026
- **Vector:** Social Engineering / SEO Poisoning
- **Details:** Attackers created 240+ distribution URLs and 3,820 unique malicious JAR files disguised as popular Minecraft clients (e.g., Wurst, Meteor, LiquidBounce). Links were promoted via high-quality YouTube videos and fake websites mimicking legitimate GitHub projects.
### Lateral Movement
- **Details:** The malware primarily functions as an infostealer on personal devices; however, the "Premium" tier provides Remote Access Trojan (RAT) capabilities, including remote shell and file management, which could be leveraged for further movement in a networked environment.
### Data Exfiltration/Impact
- **Details:** Theft of session IDs, cookies, and passwords from 36 browsers. Targeted exfiltration of 56 crypto extensions and 12 wallet apps. Premium versions included webcam access, keylogging, and remote input control.
### Detection & Response
- **Discovery:** Identified through McAfee telemetry data and analysis of malicious JAR submissions.
- **Response Actions:** Public disclosure and technical analysis of the MaaS infrastructure and Telegram communication channels.
## Attack Methodology
- **Initial Access:** Malicious JAR files distributed via poisoned search results and YouTube descriptions.
- **Persistence:** Implementation via malicious Java-based mods that execute upon game startup.
- **Defense Evasion:** Use of legitimate-looking websites that ironically link to "official" sources to gain trust; widespread distribution across thousands of unique file hashes.
- **Credential Access:** Scraping saved browser passwords and stealing Discord/Steam/Telegram tokens.
- **Discovery:** Dashboard provided to "customers" showing infected system profiles.
- **Collection:** Automated extraction of cookies and Minecraft session tokens.
- **Exfiltration:** Data sent back to a centralized MaaS dashboard hosted on the clear net.
- **Impact:** Financial loss via crypto theft; privacy violation via webcam/remote control.
## Impact Assessment
- **Financial:** High potential for loss across 116,000+ victims via crypto-wallet draining.
- **Data Breach:** Extensive theft of PII, login credentials, and session tokens.
- **Operational:** System instability and unauthorized remote control of victim hardware.
- **Reputational:** Erosion of trust within the Minecraft modding and open-source community.
## Indicators of Compromise
- **Network:** weedhack[.]xyz (and associated subdomains/distribution URLs).
- **File:** Malicious `.jar` files disguised as "Skytils," "Meteor Client," or "Wurst Client."
- **Behavioral:** Unauthorized modifications to Minecraft `%appdata%` folders; unexpected Java processes making outbound connections to non-Mojang/Microsoft servers.
## Response Actions
- **Containment:** Removal of malicious YouTube videos and flagging of distribution domains.
- **Eradication:** Users must delete infected `.jar` files and clear browser caches/cookies.
- **Recovery:** Mandatory password resets for all accounts (Discord, Steam, Email, Bank) and rotation of Minecraft session IDs.
## Lessons Learned
- **The "Legitimacy Trap":** Attackers are increasingly using high-quality production (voice-overs) and referring to real GitHub repositories to mask malicious intent.
- **MaaS Accessibility:** The "Free-to-use" model for low-tier stealers accelerates the volume of infections by lowering the barrier to entry for amateur threat actors.
## Recommendations
- **Source Verification:** Only download mods from reputable platforms like CurseForge, Modrinth, or official GitHub releases.
- **File Integrity:** Use checksums (SHA-256) to verify the integrity of downloaded JAR files against known-good hashes.
- **Security Awareness:** Educate younger users on the risks of "cracked" clients or "cheats" which are common delivery vehicles for malware.