Weedhack Targets Minecraft Players as CountLoader Hits 86,000, Pirated Sites Spread Miner
Summary
Researchers report that Weedhack targets Minecraft players through YouTube and SEO poisoning, CountLoader has infected an estimated 86,000 machines, and pirated streaming sites distribute a cryptocurrency miner through fake updates.
Key points
- McAfee Labs says Weedhack has been active since January 2026 and identified 3,820 malicious JAR files and more than 240 distribution URLs.
- Weedhack uses SEO poisoning and YouTube links to deliver malicious JARs; its infection chain uses EtherHiding to find a C2 server and installs payloads for data theft and remote access.
- McAfee Labs estimates CountLoader has infected 86,000 machines, including about 9,000 through USB drives and other removable media; recent payloads include a cryptocurrency clipper.
- Kaspersky reports that pirated movie and TV streaming sites distribute SilentCryptoMiner disguised as a video-player update, using DLL side-loading.
- The miner campaign also installs a RAT with remote-control capabilities and launches CPU- and GPU-based miners.
Article Details
- Event Type
- Multiple malware-distribution campaigns targeting Minecraft players and users of pirated streaming sites, alongside a large-scale CountLoader campaign.
- Impact
- Weedhack steals credentials and system information and enables remote access; McAfee Labs reported that customers also used its capabilities to harass and monitor victims. CountLoader is estimated to have compromised about 86,000 machines, including approximately 9,000 infections attributed to USB and removable-media spread, and the latest attacks deployed a cryptocurrency clipper. A separate pirated-content campaign distributes SilentCryptoMiner.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | weedhack[.]to | Campaign dashboard used by Weedhack customers to access stolen credentials and system information and remotely monitor compromised systems. |
MITRE ATT&CK
T1056.001 · KeyloggingWeedhack’s premium capabilities include keylogging.T1059.001 · PowerShellCountLoader infection begins with an EXE launching a PowerShell command.T1059.007 · JavaScriptCountLoader is an obfuscated JavaScript loader that is downloaded and executed.T1091 · Replication Through Removable MediaCountLoader attempts to spread through USB drives and removable media.T1105 · Ingress Tool TransferMalware downloads additional payloads, including JAR files and payloads instructed by the C2 server.T1113 · Screen CaptureWeedhack can capture screenshots.T1204.002 · Malicious FileUsers are induced to download and execute malicious files, including JAR files and an EXE.T1218.005 · MshtaThe CountLoader JavaScript loader is executed using mshta.exe.T1496 · Resource HijackingSilentCryptoMiner launches CPU and GPU cryptocurrency miners.T1555.003 · Credentials from Web BrowsersWeedhack harvests passwords and other data from web browsers.T1574.002 · DLL Side-LoadingA malicious DLL is loaded through DLL side-loading alongside a legitimate executable.
People
Malware
Amatera StealerIt’s known to deploy various payloads like Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and PureMiner.CountLoaderMcAfee Labs also reported related campaigns including CountLoader infections and a pirated-content operation delivering SilentCryptoMiner, withPureHVNC RATIt’s known to deploy various payloads like Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and PureMiner.PureMinerIt’s known to deploy various payloads like Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and PureMiner.SilentCryptoMinerMcAfee Labs also reported related campaigns including CountLoader infections and a pirated-content operation delivering SilentCryptoMiner, withWeedhackResearchers uncovered Weedhack, a Minecraft-themed malware-as-a-service campaign spread through YouTube and SEO poisoning that uses malicious JAR files, EtherHiding, and a multi-stage infection chain to steal data and
Products
Microsoft Defender Antimalware Platformfetch another Java-based JAR payload (“Elevator.jar”) that collects system information, configures Microsoft Defender exclusions, and serves as a conduit for dropping two additional JAR payloads.MinecraftResearchers uncovered Weedhack, a Minecraft-themed malware-as-a-service campaign spread through YouTube and SEO poisoning that uses malicious JAR files, EtherHiding, and a multi-stage infection chain to steal data andTelegramThe threat actors behind the tooling leverage a Telegram channel to advertise their warez, broadcast updates, and provide customer support.
Tools
Countries
CanadaThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.FinlandThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.GermanyThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.IndiaThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.IndonesiaMcAfee Labs said the highest number of infections was observed in India, followed by Indonesia, the U.S., and several countries across Southeast Asia, adding it was able to successfully sinkhole the malwareItalyThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.NorwayThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.SpainThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.SwedenThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.United KingdomThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.United StatesThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.VietnamThe majority of Weedhack infections have been identified in the U.S., followed by Germany, India, the U.K., Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.