A malware campaign targeting Minecraft players has infected more than 116,000 systems since January, according to a technical analysis by McAfee. The operation, dubbed WeedHack, spreads through malicious mods, clients, cheats and utilities promoted on YouTube and through SEO poisoning.
KEY FACTS
- Infections 116,464 systems hit since January
- Daily volume About 2,000 to 3,000 infections a day
- Targets Victims mostly in the United States, Germany, India and the UK
- Reach More than 240 distribution URLs and 3,820 malicious JAR files
The report says the campaign uses Minecraft related videos on YouTube and places download links in descriptions and comments. Some of the videos appear polished, include voice-over narration and have drawn more than 7,500 views.
SEO poisoning is also used to push fake downloads for popular client names including Meteor Client, Wurst Client, Aristois, LiquidBounce and others. In one case, a malicious site linked to a legitimate GitHub repository and Discord server for Skytils while warning users about fake copies.
The WeedHack platform runs on the clear net and gives users a dashboard showing victims, infected system profiles, stolen data and a payload builder for Minecraft versions 1.21.0 through 1.21.10. The free tier targets session IDs, cookies, saved passwords, browser data, cryptocurrency add-ons, wallet apps, Discord, Steam and Telegram credentials, and can also capture screenshots.
A paid version costs $5 a month or $24.99 for lifetime access and adds remote control, webcam access, a keylogger, remote shell and file management. McAfee said the project’s Telegram channel has more than 800 members and that many users appear to be teenagers or young adults who use the tools to harass victims.
WHY IT MATTERS
The campaign shows how gaming communities can be targeted through search results and social platforms with malware disguised as trusted tools. Players are advised to use official sources, verify download links and avoid JAR files from questionable sites, with the in-game Minecraft Marketplace cited as the safest option.