WeedHack Minecraft Infostealer Campaign Hits 116,000 Systems
Summary
McAfee telemetry attributes 116,464 impacted systems to the WeedHack campaign, which distributes malicious Minecraft tools and steals credentials and wallet data. Its premium tier adds remote-access features.
Key points
- McAfee telemetry recorded 116,464 impacted systems since January, averaging 2,000–3,000 infections daily; most victims were in the United States, Germany, India, and the UK.
- The campaign spreads malicious Minecraft mods, clients, cheats, and utilities through YouTube links and SEO poisoning.
- McAfee identified more than 240 distribution URLs and 3,820 unique malicious JAR files.
- WeedHack operates as malware-as-a-service, with a dashboard for viewing stolen data and infected-system profiles and a payload builder for Minecraft versions 1.21.0–1.21.10.
- The free tier targets Minecraft session IDs, browser cookies and passwords, cryptocurrency data, Discord, Steam, and Telegram credentials, and can capture screenshots.
- A premium tier adds remote control, webcam access, keylogging, remote shell, and remote file management.
- McAfee says some clients use the remote-access tools to harass victims; the article advises downloading mods only from official project sources.
Article Details
- Event Type
- Malware-as-a-service infostealer campaign targeting Minecraft players
- Impact
- McAfee telemetry indicates WeedHack has infected 116,464 systems since January, with an estimated 2,000–3,000 infections per day. The malware steals Minecraft session IDs, cookies, saved passwords, cryptocurrency wallet data, and credentials for services including Discord, Steam, and Telegram. Its premium tier also offers remote control, webcam access, keylogging, a remote shell, and remote file management.
MITRE ATT&CK
T1056.001 · KeyloggingThe premium tier includes a keylogger.T1113 · Screen CaptureThe free tier can capture screenshots.T1539 · Steal Web Session CookieThe free tier is reported to steal cookies and Minecraft session IDs.T1555.003 · Credentials from Web BrowsersThe free tier is reported to steal saved passwords from browsers.
Malware
Products
MinecraftWeedHack is a large-scale malware-as-a-service infostealer campaign targeting Minecraft players, with more than 116,000 infected systems since January.YouTubeIt spreads through malicious Minecraft mods, clients, cheats, and utilities promoted on YouTube and via SEO poisoning, while its operators use a dashboard to track stolen data and compromised systems.
Countries
GermanyMost victims are in the United States, Germany, India, and the UK.IndiaMost victims are in the United States, Germany, India, and the UK.United KingdomMost victims are in the United States, Germany, India, and the UK.United StatesMost victims are in the United States, Germany, India, and the UK.