Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning
Summary: McAfee Labs detected and blocked more than 6,300 attempts to reach sites distributing a malware family called Weedhack through fake Minecraft clients, with lookalike gaming sites copying branding, feature lists, FAQs, and links to genuine GitHub repositories. The attack uses SEO poisoning and YouTube to push traffic to bogus domains, then runs a multi-stage sequence ending in JAR payloads that collect system information, set Microsoft Defender exclusions, and steal data; 49.6% of the malicious URLs were Discord links, 23.4% MediaFire, and 8.2% GitHub.
Bottom line: Fake Xenon Client and Nova Client sites rank at the top of Google, Bing, Brave Search, and DuckDuckGo results, so the search engine itself is delivering the payload to users who believe they are downloading the official client.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026