Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

Cybersecurity researchers have uncovered an ongoing campaign where the Weedhack malware is being actively distributed to gamers by masquerading as legitimate Minecraft clients. Malicious websites, designed to mimic popular gaming projects with convincing branding, feature lists, and even links to genuine GitHub repositories, are luring unsuspecting users into downloading compromised software.

McAfee Labs reported detecting and blocking over 6,300 attempts to access these deceptive sites. The attackers are employing sophisticated tactics, including the use of AI-powered website builders like Lovable, which significantly lowers the barrier to entry for creating convincing malicious online presences. This trend highlights how readily available tools can empower threat actors to launch more effective phishing and malware distribution schemes.

First documented in June 2026, Weedhack has a history of utilizing SEO poisoning and YouTube redirects to drive traffic to its bogus domains. The malware's attack chain is multi-staged, culminating in the deployment of JAR payloads. These payloads are capable of collecting sensitive system information, establishing exclusions within Microsoft Defender to evade detection, and ultimately stealing valuable data from the compromised host.

Analysis of the distribution channels reveals a heavy reliance on familiar platforms alongside fake websites. McAfee Labs noted that nearly half of the identified malicious URLs were Discord links, followed by MediaFire and GitHub. This indicates a strategy of using trusted communication and file-sharing platforms to distribute links to the fake websites, further increasing the likelihood of user engagement.

Several specific examples of impersonated clients and their malicious counterparts have been identified. These include fake sites for popular Minecraft add-ons and clients such as Glazed Client, Radium Client, Meteor Clients, and Xenon Client. Notably, some of these fake domains have been engineered to outrank the official sources in search engine results through SEO poisoning, making it difficult for users to distinguish between legitimate and malicious downloads.

Beyond dedicated spoofed websites, attackers are also leveraging file hosting services and GitHub repositories for distribution. Links to these malicious JAR files are often shared across various communication channels like Discord and Reddit. Furthermore, legitimate destinations for Minecraft tools, such as Planet Minecraft and EndMods, have also been observed hosting the malware, adding another layer of complexity to detection and prevention efforts.

To mitigate the risks associated with Weedhack and similar threats, users are advised to maintain up-to-date systems, exclusively download software from trusted sources, and always scan files before execution. A critical red flag is any mod or cheat prompting users to disable security protections during installation. This campaign underscores the persistent threat of malware distribution through social engineering and deceptive online practices targeting popular gaming communities.