Full Report
Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Minecraft clients. McAfee Labs said it detected and blocked more than 6,300 attempts to access malicious sites, adding that it found lookalike gaming websites designed to mimic legitimate projects, including branding, feature lists, FAQs,
Analysis Summary
# Tool/Technique: Weedhack
## Overview
Weedhack is a multi-stage malware family primarily targeting the gaming community, specifically Minecraft players. It is distributed through sophisticated SEO poisoning campaigns and social engineering, masquerading as popular Minecraft clients, mods, and seed-cracking tools. The malware utilizes JAR-based payloads to compromise host systems and exfiltrate sensitive data.
## Technical Details
- **Type:** Malware family / Infostealer
- **Platform:** Cross-platform (Java-based JAR payloads), primarily targeting Windows users.
- **Capabilities:** System information gathering, security software evasion, data exfiltration, and persistence.
- **First Seen:** June 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1584.001 - DNS Server](https://attack.mitre.org/techniques/T1584/001/) (Use of lookalike domains)
- [T1566.002 - Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/) (Distribution via Discord/Reddit)
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/) (Setting Microsoft Defender exclusions)
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery](https://attack.mitre.org/techniques/T1082/)
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041/)
## Functionality
### Core Capabilities
- **Information Stealing:** Collects sensitive data and system metadata from the compromised host.
- **Security Evasion:** Automatically configures Microsoft Defender exclusions to prevent detection of its malicious components.
- **Multi-stage Execution:** Employs a sequenced delivery method starting from a web download to final JAR payload execution.
### Advanced Features
- **AI-Generated Impersonation:** Use of AI website builders (e.g., Lovable) to create highly convincing clones of legitimate developer websites, including FAQs and installation guides.
- **SEO Poisoning:** Leveraging search engine optimization to outrank official GitHub and Modrinth repositories for popular Minecraft tools.
## Indicators of Compromise
- **File Names:** Frequently uses names of popular Minecraft clients (e.g., Glazed, Radium, Meteor, Xenon, Nova).
- **Network Indicators (Defanged):**
- glazed-client[.]com
- radium-client[.]com
- seedcrackerx.github[.]io
- cheatlib[.]xyz
- meteorclients[.]com
- 22qq-client[.]com
- kryptonclientcrack.lovable[.]app
- nova-client[.]com
- xenoclient[.]lol
- xenonclient[.]com
- **Distribution Channels:** Discord (approx. 50% of links), MediaFire (23.4%), GitHub (8.2%), Planet Minecraft, and EndMods.
## Associated Threat Actors
- Unknown (Current research attributes the campaign to unidentified actors utilizing SEO poisoning and AI-assisted site building).
## Detection Methods
- **Signature-based detection:** Identifying the specific hash signatures of the malicious JAR payloads.
- **Behavioral detection:** Monitoring for unauthorized modifications to Microsoft Defender exclusion lists or unexpected Java processes initiating outbound data transfers.
- **Web Scanning:** Identifying lookalike domains that mimic legitimate Minecraft project branding.
## Mitigation Strategies
- **Trusted Sources:** Only download gaming clients and mods from verified platforms such as official GitHub repositories or Modrinth.
- **User Education:** Train users to identify "typosquatting" (e.g., meteorclient vs. meteorclients) and to be wary of mod installers that require disabling antivirus software.
- **Endpoint Protection:** Ensure Microsoft Defender or other EDR solutions are locked against unauthorized configuration changes to exclusion lists.
## Related Tools/Techniques
- **Remus Stealer / AnimateClipper:** Often distributed via similar SEO poisoning/TDS campaigns.
- **SessionGate Framework:** A related delivery framework for gaming-focused malware.
- **SEO Poisoning:** A general technique used to redirect users from official software sources to malicious clones.