Weedhack Attacks Minecraft Users, Count Loader Hits 86K, Miners Spread via Pirated Content
Summary: McAfee Labs flagged a Minecraft-focused malware-as-a-service campaign called Weedhack, active since January 2026, that impersonates Minecraft clients and mods and has been tied to 3,820 unique malicious JAR files and over 240 distribution URLs spread through SEO poisoning and YouTube videos. The malware resolves its command-and-control domain through the Ethereum blockchain via EtherHiding, harvests Minecraft session data including live Microsoft OAuth access tokens, and is advertised on a Telegram channel with more than 850 members, with most infections in the U.S., Germany, India, and the U.K.
Key Takeaway: Dark Atlas reported over 116,000 endpoints compromised between January and June 2026, and McAfee observed customers, described as teenagers and young adults, using the tool's remote access to record victims via webcam and post the videos on Telegram as trophies.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026