At a Glance Malware Family Marsalek malware (Python intermediate stealers and PureLog .NET fourth-stage infostealer) Threat Actor Confirmed link to the WeedHack MaaS ecosystem via the @MetaMaskenMann Telegram support channel; PureLog originally created by "PureCoder" Target / Victims

Security researchers at McAfee say a malicious campaign dubbed “WeedHack” has been targeting Minecraft players—and it’s getting more aggressive, not less. In June, McAfee observed WeedHack operations using fake “game client” pages to lure victims. The twist: when the original command-and-control (C2) channel was disclosed and then went dead, attackers didn’t stop. Instead, they pivoted—repackaging delivery and continuing distribution via community platforms. McAfee reports WeedHack has been active since January 2026, infecting 116,000+ players so far. It’s essentially a “malware-as-a-service” (MaaS) operation: criminals provide the infrastructure so less technical actors can replicate the attack chain. After infection, WeedHack aims to steal passwords and browser data, then harvest Minecraft and Discord account information, and finally target crypto wallet contents to monetize the breach. Even after initial disclosure, intel suggests at least a dozen additional malicious sites kept pushing samples. Attackers also used SEO manipulation and lookalike landing pages that appear to link to trusted resources (including seemingly legitimate GitHub repositories). What you can do: verify domains before installing “client” tools; review browser logins, Discord access, and wallet permissions regularly. #CyberSecurity #Malware #Minecraft #Phishing #Discord #CryptoScams

WeedHackのコマンド&コントロール(C2)インフラを遮断しても、その拡散は止まりませんでした。偽のMinecraftクライアントサイトや信頼されたホスティングサービスが、元のバックエンドが停止した後もマルウェアの配布を続けていたのです。 McAfeeが8月20日に発表した続報によると、1か月間の観測期間中

McAfeeがMinecraftプレイヤーを標的とするマルウェア「WeedHack」を解説。信頼できるプラットフォームを悪用した感染経路や、機密情報の窃取といった脅威の実態を明らかにします。

Weedhack Malware Actively Exploiting Minecraft Modding Community via SEO Poisoning and Fake Client Downloads  Rescana

Sicherheitsanalysten beobachten derzeit eine verstärkte Aktivität von Plattformen, die unter dem Anschein seriöser Anwendungen für Sport oder Systemsicherheit agieren, um Nutzern schadhafte Software unterzuschieben. Diese Plattformen nutzen das Vertrauen in bekannte App-Kategorien aus, um Infostealer und andere Malware-Typen zu verbreiten, die sensible Nutzerdaten wie Passwörter, Sitzung-Cookies und Krypto-Wallets ins Visier nehmen.Gezielte Täuschung im Gaming-SektorEin Schwerpunkt […] The post Gefälschte Gaming-Apps: Weedhack und Vidar-Malware im Umlauf appeared first on BornCity.

Das verstärkte Angebot mobiler Anwendungen über Webseiten von Drittanbietern führt aktuell zu erheblichen Sicherheitsrisiken für Endnutzer. Experten beobachten eine Zunahme von gefälschten Plattformen, die gezielt populäre Anwendungen und Trends ausnutzen, um Schadsoftware zu verbreiten. Dabei kommen oft technische Täuschungsmanöver zum Einsatz, die selbst für erfahrene Anwender schwer zu identifizieren sind.Malware-Fallen bei Gaming-Inhalten und Unterhaltungs-AppsEin deutlicher […] The post Malware-Welle: 6.300 gefälschte Minecraft-Seiten mit Weedhack appeared first on BornCity.

Weedhack Malware Actively Exploiting Minecraft Modding Community via SEO Poisoning and Fake Client Downloads  Rescana

Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning  The Hacker News

At a Glance Malware family WeedHack (Malware-as-a-Service infostealer) Threat actor Unnamed MaaS operators and customers (not publicly attributed) Targets / victims Minecraft gamers; over 116,464 infected per prior reporting Delivery vector Fake client sites, SEO poisoning, Discord, MediaFire, GitHub Key capabilities Trojanized JAR downloads impersonating Minecraft clients Source McAfee Labs research report TL;DR WeedHack malware is still spreading, even after McAfee disrupted its main server.

Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning  The Hacker News

Cybersecurity researchers found that multiple fake Minecraft client websites are still distributing Weedhack to gamers through SEO poisoning, Discord, GitHub, and other trusted platforms. The campaign uses convincing lookalike pages and legitimate-looking hosting services to deliver JAR payloads that can gather system data, add Microsoft Defender exclusions, and steal information. #Weedhack...

A threat actor keeps spreading the WeedHack malware to Minecraft players despite its original infrastructure taken down in July

WeedHack Minecraft Malware Survives C2 Takedown: Fake Client Sites Still Active, SEO Poisoning Puts Malicious Downloads at the Top of Google McAfee Labs published a follow-up report on the WeedHack Malware-as-a-Service campaign this week, documenting ten active malicious sites and multiple file-hosting accounts that are still spreading the infostealer despite a disruption to its command-and-control […]

Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Minecraft clients. McAfee Labs said it detected and blocked more than 6,300 attempts to access malicious sites, adding that it found lookalike gaming websites designed to mimic legitimate projects, including branding, feature lists, FAQs,

McAfee bloqueó más de 6.300 intentos de acceso a sitios maliciosos que imitan a la perfección proyectos legítimos, con uno de ellos construido con una herramienta de IA. (Fuente: The Hacker News) Investigadores de ciberseguridad encontraron que varios sitios web siguen distribuyendo activamente una familia de malware conocida como Weedhack a jugadores, haciéndose pasar por clientes de Minecraft. McAfee Labs dijo haber detectado y bloqueado más de 6.300 intentos de acceso a sitios maliciosos, y encontró sitios de juegos que imitan proyectos legítimos, incluyendo el diseño de marca, listas de funciones, preguntas frecuentes, guías de instalación, créditos de desarrolladores y enlaces a repositorios reales de GitHub.

Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Minecraft clients. McAfee Labs said it detected and blocked more than 6,300 attempts to access malicious sites, adding that it found lookalike gaming websites designed to mimic legitimate projects, including branding, feature lists, FAQs,

Cryptika (relayant CyberSecurityNews), publié le 25 août 2026. McAfee a publié un rapport détaillant la campagne WeedHack, une opération de distribution de malware ciblant les joueurs Minecraft via l'empoisonnement de résultats de recherche Google (SEO poisoning).

Weedhack spreads through fake Minecraft client sites and SEO poisoning, with McAfee blocking more than 6,300 attempts to reach malicious URLs.