Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown
McAfee says WeedHack infostealer MaaS still spreads via ten fake Minecraft client sites and SEO poisoning despite C2 takedown, with 116,464 infections logged.
45
Vendor
McAfee
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 17, 2026
- Last mentionedAug 25, 2026
Timeline
3 articles · newest firstThreat Brief: Maze Ransomware
Unit 42 issued a threat brief on Maze ransomware, noting an uptick across industries and exploitation of Pulse VPN and IE flaws for initial access.
55
Threat Assessment: Egregor Ransomware
Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.
55
Related CVEs
by mentions- CVE-2019-11510100%10.0Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
- CVE-2018-487890%7.8Use-After-Free RCE in Adobe Flash Player before 28.0.0.161
- CVE-2018-1598290%7.8Use-After-Free in Adobe Flash Player Allows Arbitrary Code Execution
- CVE-2018-817488%7.5Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine
Appears with
- Palo Alto Networksorganization · 2
- Palo Alto Networksvendor · 2
- Cortex XDRproduct · 2
- Unit 42organization · 2
- MediaFirevendor · 1
- Egregormalware · 1
- GitHubvendor · 1
- WildFireproduct · 1
- Sekhmetmalware · 1
- Discordvendor · 1
- Ursnifmalware · 1
- Cobalt Strikemalware · 1
- IcedIDmalware · 1
- ChaChamalware · 1
- Xenon Clientproduct · 1
- WeedHackmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.