Weedhack Malware Campaign Uses Fake Minecraft Clients and SEO Poisoning
Summary
McAfee Labs reports that fake Minecraft client sites and links on familiar platforms are distributing Weedhack. It detected and blocked more than 6,300 attempts to access malicious sites; JAR payloads can collect system data, add Defender exclusions, and steal sensitive
Key points
- McAfee Labs says it detected and blocked more than 6,300 attempts to access malicious sites distributing Weedhack.
- Lookalike websites copy legitimate Minecraft projects’ branding and documentation; one fraudulent site was built with the Lovable website builder.
- Distribution uses SEO poisoning and links shared through Discord, Reddit, GitHub, file hosts, and Minecraft tool sites.
- McAfee Labs reported that Discord links accounted for 49.6% of identified malicious URLs, followed by MediaFire at 23.4% and GitHub at 8.2%.
- The multi-stage attack delivers JAR payloads that can collect system information, add Microsoft Defender exclusions, and steal sensitive data.
- McAfee Labs recommends using trusted sources, scanning files before opening them, keeping devices updated, and avoiding mods that ask users to disable security protections.
Article Details
- Event Type
- Malware distribution campaign using fake Minecraft client websites and SEO poisoning
- Impact
- McAfee Labs reported detecting and blocking more than 6,300 attempts to access malicious sites. Weedhack-laced JAR payloads can collect system information, add Microsoft Defender exclusions, and steal sensitive data from compromised hosts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 22qq-client[.]com | Fake Minecraft mod domain identified as distributing Weedhack and impersonating a mod of the same name. |
| DOMAIN | cheatlib[.]xyz | Fake Minecraft mod-library domain identified as distributing Weedhack. |
| DOMAIN | glazed-client[.]com | Fake Minecraft client domain identified as distributing Weedhack and impersonating glazedclient[.]com. |
| DOMAIN | meteorclients[.]com | Fake Minecraft client domain identified as distributing Weedhack and impersonating meteorclient[.]com. |
| DOMAIN | nova-client[.]com | Fake Minecraft client domain identified as distributing Weedhack. |
| DOMAIN | radium-client[.]com | Fake Minecraft client domain identified as distributing Weedhack and impersonating radiumclient[.]com. |
| DOMAIN | xenoclient[.]lol | Fake Minecraft client domain identified as distributing Weedhack and impersonating Xenon client. |
| DOMAIN | xenonclient[.]com | Fake Minecraft client domain identified as distributing Weedhack and impersonating Xenon client. |
| HOSTNAME | kryptonclientcrack[.]lovable[.]app | Fake Minecraft client hostname identified as distributing Weedhack and impersonating kryptonclient[.]org. |
| HOSTNAME | seedcrackerx[.]github[.]io | Spoofed Minecraft seed-cracking site identified among domains distributing Weedhack. |
MITRE ATT&CK
People
Malware
Products
DiscordCybersecurity researchers found that multiple fake Minecraft client websites are still distributing Weedhack to gamers through SEO poisoning, Discord, GitHub, and other trusted platforms.GitHubCybersecurity researchers found that multiple fake Minecraft client websites are still distributing Weedhack to gamers through SEO poisoning, Discord, GitHub, and other trusted platforms.Lovable#WeedhackMicrosoft Defender Antimalware PlatformThe campaign uses convincing lookalike pages and legitimate-looking hosting services to deliver JAR payloads that can gather system data, add Microsoft Defender exclusions, and steal information.MinecraftCybersecurity researchers found that multiple fake Minecraft client websites are still distributing Weedhack to gamers through SEO poisoning, Discord, GitHub, and other trusted platforms.