Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown
McAfee says WeedHack infostealer MaaS still spreads via ten fake Minecraft client sites and SEO poisoning despite C2 takedown, with 116,464 infections logged.
McAfee Labs' follow-up on the WeedHack Malware-as-a-Service operation, first documented in June 2026, found ten active fake Minecraft client sites and multiple file-hosting accounts still distributing the infostealer even after its C2 server went dark; over 6,300 user attempts were blocked in the past month. The campaign, running since January with 116,464 infected systems and 2,000-3,000 daily new victims, offered a free Discord-gated tier and a $5/month premium tier with webcam surveillance, and stole session cookies, passwords, browser data, and cryptocurrency wallets. Distribution relies on SEO poisoning that ranked fake sites such as nova-client.com above genuine GitHub repositories, with most malicious links coming via Discord (49.6%) and MediaFire (23.4%), and one fake site built with the AI website builder lovable.app.
- WeedHack operation has logged 116,464 infected systems since January, adding 2,000-3,000 daily
- EtherHiding fetches the attacker's C2 address from the Ethereum blockchain to survive takedowns
- Top two Google results for Xenon Client led to fake sites distributing WeedHack
- Malicious links mostly via Discord (49.6%) and MediaFire (23.4%); one fake site built with lovable.app
- Premium tier at $5/month offered webcam surveillance and a victim-monitoring dashboard
- Products
- Xenon Client
- Malware
- WeedHack
- Organizations
- McAfee Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | nova-client.com | e official websites, only GitHub pages and Discord servers. Nova-client.com is a fake website for a client that has no real website; th |
From the original article
3 min read at securityaffairs.com
WeedHack Minecraft Malware Survives C2 Takedown: Fake Client Sites Still Active, SEO Poisoning Puts Malicious Downloads at the Top of Google McAfee Labs published a follow-up report on the WeedHack Malware-as-a-Service campaign this week, documenting ten active malicious sites and multiple file-hosting accounts that are still spreading the infostealer despite a disruption to its command-and-control infrastructure.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.