Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning
McAfee Labs reports Weedhack malware spread via spoofed Minecraft client websites using SEO poisoning, with over 6,300 blocked access attempts.
McAfee Labs found multiple lookalike websites impersonating legitimate Minecraft clients (Glazed, Radium, Meteor, Nova, Xenon) still distributing Weedhack, a multi-stage malware whose JAR payloads collect system information, add Microsoft Defender exclusions, and steal sensitive data. Distribution relies on SEO poisoning to outrank official sources, plus Discord, MediaFire, GitHub, and Minecraft hosting sites; nearly half of malicious URLs were Discord links. One fake site was built with the AI website builder Lovable, and McAfee blocked more than 6,300 access attempts to malicious sites.
- Spoofed Minecraft client sites outrank official sources in search
- 6,300+ malicious site access attempts detected and blocked
- Payloads disable Defender exclusions protections and steal data
- 49.6% of malicious URLs were Discord links
- Fake sites built with Lovable AI website builder
- Products
- MinecraftMicrosoft Defender
From the original article
2 min read at thehackernews.com
Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Minecraft clients.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.