McAfee Labs published a follow-up report on the WeedHack Malware-as-a-Service campaign this week, documenting ten active malicious sites and multiple file-hosting accounts that are still spreading the infostealer despite a disruption to its command-and-control infrastructure. Over the past month alone, McAfee WebAdvisor blocked more than 6,300 user attempts to reach these sites.
WeedHack was first spotted in early June 2026 when McAfee researcher Aayush Tyagi documented a Malware-as-a-Service operation that had been running since January and had logged 116,464 infected systems, adding between 2,000 and 3,000 new victims every day. The operation offered a free tier that anyone with a Discord account could access, a premium tier with webcam surveillance capability for $5 a month, and a dashboard letting operators view stolen credentials, configure custom payloads, and monitor victims in real time. It spread through fake Minecraft client websites, YouTube videos linking to malicious downloads, and SEO poisoning that pushed those fake sites to the top of search results for popular Minecraft tool names. The malware stole session cookies, passwords, browser data, and cryptocurrency wallet contents, and used EtherHiding, a technique that fetches the attacker’s active server address from the Ethereum blockchain, to maintain contact with its infrastructure even when individual servers were shut down.
“During our investigation of this campaign, we observed that most of these websites appear legitimate, as they are well-crafted and often mimic legitimate websites. We observed a series of dedicated brand-impersonation attacks targeting several popular Minecraft clients.” reads the report published by McAfee.
“We published the original article in the first week of July, and, as a result, we’ve seen a disruption in WeedHack’s campaign: its C2 server is no longer active. Consequently, we have observed a shift in tactics by these attackers. “
The dashboard is gone. The distribution sites are not.
Each fake website copies the real tool’s features, FAQs, installation steps, developer information and even links to legitimate GitHub repositories. The sites look detailed and convincing, so most users have little reason to suspect anything.
The attackers also use search rankings to reach victims. Researchers found that the first two Google results for “Xenon Client,” a popular Minecraft client, led to fake sites distributing WeedHack. The sites offered installation guides, free and paid downloads, and links to the real Xenon Client GitHub repository. A player searching for the tool, clicking the first result and downloading the file could easily end up installing malware.
The campaigns exploit a structural weakness in the Minecraft modding community: many popular tools don’t have official websites, only GitHub pages and Discord servers. Nova-client.com
is a fake website for a client that has no real website; the attackers built one and ranked it above the genuine GitHub repository. 22qq-client.com
does the same for a Crystal PVP mod. For nova-client.com
, the researchers specifically noted that the credits section lists generic team names instead of anyone who actually worked on the project, which is one of the cleaner ways to spot an impersonation if you know who the real developers are.
One site in the campaign was built using lovable.app
, an AI-powered web application builder that accepts natural language instructions and produces working sites. The platform is legitimate; the use here is not. The ready availability of tools like this means the cost and technical skill required to launch a new convincing fake gaming site is now close to zero.
McAfee found that most malicious links came through Discord (49.6%), followed by MediaFire (23.4%), GitHub (8.2%) and Dropbox (4.6%). One Discord channel promoting fake DonutSMP clients had more than 1,900 members, while another site offered eight different mods that all delivered the same malware.
The campaign also spread through trusted Minecraft communities such as Planet Minecraft and EndMods, making the scams harder to spot because users already trusted these platforms.
McAfee recommends downloading mods and clients only from official developer repositories or trusted platforms such as Modrinth and CurseForge. If a tool asks you to disable antivirus protection, treat it as malware.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, malware)