Full Report
A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January. [...]
Analysis Summary
# Incident Report: WeedHack Malware Campaign
## Executive Summary
The WeedHack malware campaign is a large-scale Malware-as-a-Service (MaaS) operation targeting Minecraft players through malicious mods and utilities. Since January 2026, the campaign has successfully infected over 116,000 systems, functioning primarily as an information stealer with remote access capabilities. The operation utilizes social engineering via YouTube and SEO poisoning to distribute over 3,800 unique malicious JAR files.
## Incident Details
- **Discovery Date:** June 2, 2026 (Reported by McAfee)
- **Incident Date:** Ongoing since January 2026
- **Affected Organization:** Global Minecraft player base
- **Sector:** Gaming / Individual Consumers
- **Geography:** Global (Primary impact: USA, Germany, India, UK)
## Timeline of Events
### Initial Access
- **Date/Time:** January 2026 – Present
- **Vector:** Social Engineering (YouTube) and Search Engine Optimization (SEO) Poisoning.
- **Details:** Attackers promoted malicious versions of popular Minecraft clients and mods (e.g., Wurst, Meteor, Skytils) through videos and spoofed websites that mimicked official project styles.
### Lateral Movement
- **Mechanism:** The malware primarily targets individual end-user workstations. While lateral movement within a corporate network isn't the primary goal, the "Premium" tier of the malware includes a remote shell and file management, enabling further network exploration if a victim is on a sensitive network.
### Data Exfiltration/Impact
- **Details:** The malware steals Minecraft session IDs, browser cookies, saved passwords (36 browsers), Discord/Steam/Telegram tokens, and cryptocurrency wallet data. Premium versions include webcam access, keylogging, and remote input control.
### Detection & Response
- **Detection:** Identified by McAfee researchers through telemetry spikes showing 2,000–3,000 new infections daily.
- **Response Actions:** Public disclosure of the campaign, identification of over 240 malicious URLs, and blacklisting of associated malicious JAR files.
## Attack Methodology
- **Initial Access:** Distribution of malicious `.JAR` files via fake modding websites and YouTube descriptions.
- **Persistence:** Implementation varies by payload builder, often relying on standard startup folder or registry persistence common in MaaS infostealers.
- **Privilege Escalation:** Not explicitly detailed, though remote shell access allows for manual exploitation.
- **Defense Evasion:** Use of legitimate-looking websites, security warnings on fake sites to build trust, and high volume of unique file hashes (3,820+ JARs).
- **Credential Access:** Extraction of saved browser credentials and session tokens for gaming and communication platforms.
- **Discovery:** Automated system profiling visible via the WeedHack dashboard.
- **Collection:** Automated harvesting of cookies, tokens, and screenshots.
- **Exfiltration:** Data is transmitted to a centralized command-and-control (C2) dashboard hosted on the clear net.
- **Impact:** Financial loss via crypto-theft; account takeover; privacy violation via webcam/screen monitoring.
## Impact Assessment
- **Financial:** Extensive theft of cryptocurrency wallets and premium gaming accounts.
- **Data Breach:** Over 116,000 systems compromised; massive theft of PII and session tokens.
- **Operational:** System instability for victims; potential for "griefing" or harassment using remote access tools.
- **Reputational:** High impact on the Minecraft modding community's trust in third-party developers.
## Indicators of Compromise
- **Network Indicators (Defanged):**
- hxxps[://]weedhack[.]gg (Example C2/Dashboard domain)
- Various URLs promoted in YouTube descriptions (240+ identified)
- **File Indicators:**
- Over 3,820 unique malicious `.JAR` files.
- Typical naming conventions mimicking: `Meteor-Client-1.21.jar`, `Skytils-Installer.jar`, etc.
- **Behavioral Indicators:**
- Unauthorized outbound connections from `javaw.exe` to unknown clear-net dashboards.
- New startup entries originating from Minecraft mod folders.
## Response Actions
- **Containment:** Blocking known distribution URLs and C2 infrastructure.
- **Eradication:** Removal of malicious JAR files and clearing of browser/session caches to invalidate stolen tokens.
- **Recovery:** Users advised to reset all passwords and enable Multi-Factor Authentication (MFA) on all impacted accounts.
## Lessons Learned
- **The "Legitimacy" Trap:** Attackers are successfully using "Security Warnings" and links to real GitHubs on fake sites to trick savvy users.
- **MaaS Accessibility:** The "Free" tier of WeedHack lowered the barrier to entry, leading to a massive volume of low-level attackers (teenagers/harassers) participating in the campaign.
- **Jar File Risks:** Minecraft’s reliance on executable Java files remains a significant blind spot for standard consumer antivirus.
## Recommendations
- **Official Sources Only:** Only download mods from trusted repositories like CurseForge, Modrinth, or official project GitHub pages.
- **File Verification:** Use checksums (SHA-256) to verify the integrity of downloaded files if provided by the developer.
- **Environment Isolation:** Use a secondary, non-administrative user account for gaming to limit the impact of an infection.
- **Account Security:** Use MFA (Multi-Factor Authentication) for Minecraft, Discord, and Steam to prevent session ID reuse from leading to full account takeover.