Weedhack Hides Inside Fake Minecraft Clients That Outrank the Official Downloads in Google

Your kid downloaded a Minecraft client from the first result in Google. It cost the attacker 5 dollars, the panel behind it has logged 116,464 infections, and the webcam is part of what he paid for.

Minecraft is the best selling video game ever made, and almost none of it gets played plain. Players install clients, mods and utilities that add what Mojang never shipped, and those tools live on GitHub, on Modrinth and on the personal pages of the people who wrote them. No app store sits in the middle checking anything. You search for the tool by name, you click a link, you download a JAR file, and you run it. That habit is where the attack lives.

A team at McAfee Labs pulled the business apart. It calls itself Weedhack, and it has been running since January 2026. Their researcher counted more than 3,820 malicious JAR files and more than 240 URLs handing them out, and the counter on the operator’s own panel stood at 116,464 hits, climbing by 2,000 to 3,000 a day. A hit is not an attempt. Each one arrives with the machine’s hardware, IP address, user name and computer name, and a screenshot of whatever was on the screen at that moment. The infections sit heaviest in the United States, then Germany, India, the United Kingdom, Italy, Vietnam, Canada, Norway, Sweden, Finland and Spain.

Stealer families like Lumma go for 250 to 500 dollars a month, sold through Telegram channels and forums you have to find first. Weedhack sits on the ordinary web. You sign in with a Discord account. The basic version is free.

Free gets you the Minecraft session tokens and four launchers. It also takes passwords and cookies from 36 browsers, 56 browser based crypto wallets and 12 desktop ones, Discord, Steam and Telegram credentials, a file search across 24 keywords, and screenshots. Paying 5 dollars a month, or 24.99 once for life, adds the webcam, a keylogger, a reverse shell, screen sharing with keyboard and mouse control, and a file manager.

The panel ranks customers on a leaderboard by all time hits and by the last 24 hours, refreshed at ten minute intervals. It has a build section where you pick a Minecraft version between 1.21.0 and 1.21.11 and inject the malware into a working mod, so the mod still does what it promises. A tutorial section covers the remote access, what to do with stolen Discord tokens and wallet credentials, and which VPN and proxy services to hide behind. And a suggestion box lets customers vote on what gets built next. The leading requests were a jump scare function, ransomware, and microphone access.

The download reaches people along two routes, and both of them end at a link somebody trusted.

The first is YouTube. The panel tells customers to make a properly edited video with overlays and music, and warns them off AI generated content because it does not hold traffic. Put the link in the description and again in the comments. One video had a voice over walking through the mod and more than 7,500 views, with comments underneath from the operators saying the download is legitimate software.

The second is search. Some of these clients have an official website, and then it gets copied: same layout, same feature list, same FAQ, a domain one letter away. Others have no website at all, because the developer only puts the file on GitHub, and then the attacker builds the site the project never had. Either way the copy ranks above the original, with a link to the genuine GitHub repository sitting there as proof. One of those sites was built with an AI website builder, which is why they now appear faster than the projects can report them.

For Xenon Client, the top two Google results were both distributing Weedhack.

Most of those links never point at a website. Discord carries 49.6 percent of them, MediaFire 23.4, GitHub 8.2 and Dropbox 4.6, all platforms that firewalls leave open. The fake sites are what is left over. Two community sites, Planet Minecraft and EndMods, were serving infected files directly.

The sample that got taken apart in public was called Hide Item Frame, a small mod that hides the frame around an item. It carried a legitimate looking entry point next to the malicious one, and bundled genuine graphics libraries.

The chain is Java from start to finish, which is why it arrives as something a player would run without thinking.

Stage one relaunches itself through javaw.exe instead of java.exe, so no console window appears. If it is loaded as a mod inside Minecraft it harvests the player’s user name, UUID and access token and sends them out immediately, before stage two is even downloaded. Losing the game account does not require the rest of the attack to succeed.

Then it needs to know where to phone home. The address of the command server is not in the file. What sits there instead is a list of 32 public Ethereum endpoints, a smart contract address, a function to call and an RSA public key. All of it is encrypted, so the strings cannot be read out of the JAR. The malware asks the blockchain for the current address, checks the signature, and only then connects. If one endpoint is down it moves to the next. Somebody who finds the contract still cannot redirect the victims. Writing a new address into it takes the key to that wallet, and even then the malware throws away anything the operator has not signed.

Stage two comes back as raw bytes, unpacked entirely in memory through a custom class loader, and never touches the disk. It is compiled with JNIC, a commercial obfuscator that turns Java bytecode into native code inside a DLL, licensed at 150 to 300 pounds. It carries two of those libraries and no more, one for 64-bit Windows and one for Windows on ARM. Run the same file on Linux or macOS and it stops right there, with an error saying the platform is not supported.

That stage gets around the Windows permission prompt using cmstp.exe, the built in Connection Manager installer, with a crafted INF file. Then it uses the Windows API to press Enter on the prompt itself. Once elevated it drops WinDefConfig.cmd, which adds 13 excluded paths and 15 excluded processes to Windows Defender. A later stage adds the complete C:\Users folder.

Then it scans the wifi networks in range to work out roughly where the machine is, and asks the system for the Mullvad VPN account details. The Discord tokens, browser cookies and passwords go out in a database.

Persistence is a scheduled task named JavaSecurityUpdater, running at logon with the highest privileges. A second one named JMonitoringTask restarts it at two minute intervals, so removing a piece puts it back. The last stage writes firewall rules for its own backdoor and two more for javaw.exe, which lets the operator run Java code through a process Windows already trusts.

• → C:\Users\<user>\AppData\Roaming\Microsoft\SecurityUpdates\SecurityManager.jar
• → C:\Users\<user>\AppData\Roaming\Microsoft\SecurityUpdates\component.jar
• → C:\Users\<user>\AppData\Roaming\RuntimeBroker.exe
• → C:\Users\<user>\AppData\Roaming\Microsoft\Tlmtry
• → Scheduled tasks: JavaSecurityUpdater, JMonitoringTask
• → Firewall rules named Runtime Broker

The researchers watched the operator’s Telegram channel, which had over 850 members. The customers are mostly teenagers and people in their early twenties, and their victims are the same age.

What they do with the webcam access is the part the researchers refused to publish. Customers were recording the people they had infected and posting the footage in the channel as trophies. The researchers kept it out of their report, because the victims are minors. Their own dry line about the buyers is that most cannot write malware at all.

One line in that report is aimed straight at those victims. It is the only sensible thing you can tell a fourteen year old who is being blackmailed with their own webcam. Tell a parent or a guardian, and do not do what the attacker asks.

Inside the infected JAR sits a second file called fabric.api.json, containing one UUID. It is not a Fabric field, and the Minecraft mod loader does not look for it. It is the customer number of the person who paid for that build.

That number travels with it. It goes into the JSON sent to the command server, into the VBS script that relaunches the payload, and into the command line of the backdoor as --user-id. It is what puts the hit on the right customer’s leaderboard row.

Which means a machine that gets examined afterwards carries the identifier of whoever infected it. The two samples that have been pulled apart in public carry different UUIDs, 9f8f4647 and 2fbff058, because they were built by two different customers of the same service.

The second account did not come from a company. Somebody’s friend got infected and handed over the JAR file. They took it apart with a decompiler and published the lot: the source, a decoder they wrote for the 57 encrypted strings, and the full list of endpoints. Both analyses land on the same contract address, the same RSA key and the same class names, which is as close to confirmation as this work gets.

The first report came out on 2 June. The command server went down and the panel disappeared. A second report on 20 August showed the fake sites still handing out infected files.

Both analyses print the contract address, so on 29 August I queried it myself through a public Ethereum node and read its transaction history. Not the attacker’s servers, only the public chain.

The contract went up on 14 January 2026, and the first address was written into it nine minutes later, which lines up with January as the start date. It carries 21 write actions, all from the same wallet, spread over 13 days. Five of them landed within 24 minutes on that first afternoon. The last one was 19 May 2026 at 22:28 UTC.

And it still answers. Today it returns a live address with a valid signature, on a .st domain rather than the .ru ones in the reports. The takedown removed the server. The address that each infected machine reads to find the next one has never been touched, because it sits on a blockchain and there is nothing to seize.

Eleven more domains, tied to earlier campaigns from the same operator, say more than the malware does. Two of them, acabstealer.ru and 1312stealer.ru, carry the same anti police slogan written twice, once in letters and once in the numbers that stand for them. Another is dieserbenni.ru, which is German, and Germany is the second most infected country on the map in that report. A fourth is marsalek.cy, the surname of the Wirecard executive who vanished in 2020 and is thought to be in Russia.

Attribution is the hardest part of this work and I am not doing it here. Domain names are a choice, not evidence, and someone picking German words may be German, or may want to look it. What the list does show is one person with a sense of humour about themselves, running this well before Weedhack existed.

Three read only commands in PowerShell will tell you whether a machine has been through this. The exclusions are the strongest signal: nothing normal adds fifteen processes to that list.

1
2

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

Then the scheduled tasks, named to look like Windows components:

1

Get-ScheduledTask | Where-Object {$_.TaskName -match "Java|Monitoring|Updater"}

And the firewall, where a rule for javaw.exe on a machine with no Java server does not belong:

1

Get-NetFirewallRule | Where-Object {$_.DisplayName -match "Runtime Broker|javaw"}

The Minecraft side is short. Get clients and mods from the project’s own GitHub or from Modrinth. A site that tells you to switch off your antivirus before installing is telling you what the file is. The projects being impersonated did nothing wrong: their downloads are fine, and the copies outrank them.

If a machine in the house was hit, the Minecraft session token went out first, so change the Microsoft password and sign out everywhere.

You can build the lab, watch the traffic leave your own machine, and see how far an attacker gets once a file runs. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

WeedHack Returns, McAfee Labs | Weedhack reverse engineering analysis | The C2 contract on Ethereum