McAfee Reports WeedHack Malware Infected 116,464 Systems
Summary
McAfee reports that the WeedHack infostealer campaign has affected 116,464 systems, targeting Minecraft players through malicious mods, clients, cheats and utilities promoted on YouTube and through SEO poisoning.
Key points
- McAfee telemetry shows 116,464 affected systems since January, with 2,000–3,000 infections per day on average.
- The campaign spreads through malicious Minecraft mods, clients, cheats and utilities promoted in YouTube videos and search-engine results.
- McAfee identified more than 240 distribution URLs and 3,820 unique malicious JAR files.
- The infostealer targets Minecraft session IDs, browser cookies and passwords, cryptocurrency information, and credentials for services including Discord, Steam and Telegram; it can also capture screenshots.
- The free service provides a dashboard and payload builder; a paid tier adds remote control, webcam access, keylogging, a remote shell and file management.
- McAfee says some customers appear to be teenagers or young adults who use the remote-access features to harass victims.
- Minecraft players are advised to download mods from official project sources and treat JAR files from dubious sites with caution.
Article Details
- Event Type
- WeedHack malware-as-a-service infostealer campaign targeting Minecraft players through malicious mods, clients, cheats, and utilities promoted via YouTube and SEO poisoning.
- Impact
- McAfee telemetry reportedly recorded 116,464 infected systems, with an average of 2,000–3,000 infections per day. The malware steals session IDs, passwords, browser data, cryptocurrency information, and screenshots. Its premium tier adds remote-control, webcam, keylogging, remote-shell, and file-management capabilities.
MITRE ATT&CK
T1056.001 · KeyloggingThe premium tier reportedly includes a keylogger.T1113 · Screen CaptureThe article says WeedHack can capture screenshots.T1539 · Steal Web Session CookieThe article says WeedHack steals cookies and Minecraft session IDs.T1555.003 · Credentials from Web BrowsersThe article says WeedHack steals saved passwords from browsers.
Malware
Products
DiscordIt is even linking to the project’s legitimate GitHub repository and Discord server to create a strong, false sense of legitimacy for the fake website.MinecraftWeedHack is a large-scale Malware-as-a-Service infostealer campaign targeting Minecraft players through malicious mods, clients, cheats, and utilities spread via YouTube and SEO poisoning.Steampasswords across 36 browsers, 56 cryptocurrency add-ons, 12 desktop cryptocurrency wallet apps, Discord, Steam, and Telegram credentials, and can capture screenshots.Telegram36 browsers, 56 cryptocurrency add-ons, 12 desktop cryptocurrency wallet apps, Discord, Steam, and Telegram credentials, and can capture screenshots.YouTubeWeedHack is a large-scale Malware-as-a-Service infostealer campaign targeting Minecraft players through malicious mods, clients, cheats, and utilities spread via YouTube and SEO poisoning.
Countries
GermanyMost victims are in the United States, Germany, India, and the UK.IndiaMost victims are in the United States, Germany, India, and the UK.United KingdomMost victims are in the United States, Germany, India, and the UK.United StatesMost victims are in the United States, Germany, India, and the UK.