30
42
30
30
42
Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown
McAfee says WeedHack infostealer MaaS still spreads via ten fake Minecraft client sites and SEO poisoning despite C2 takedown, with 116,464 infections logged.
McAfee Labs' follow-up on the WeedHack Malware-as-a-Service operation, first documented in June 2026, found ten active fake Minecraft client sites and multiple file-hosting accounts still distributing the infostealer even after its C2 server went dark; over 6,300 user attempts were blocked in the past month. The campaign, running since January with 116,464 infected systems and 2,000-3,000 daily new victims, offered a free Discord-gated tier and a $5/month premium tier with webcam surveillance, and stole session cookies, passwords, browser data, and cryptocurrency wallets. Distribution relies on SEO poisoning that ranked fake sites such as nova-client.com above genuine GitHub repositories, with most malicious links coming via Discord (49.6%) and MediaFire (23.4%), and one fake site built with the AI website builder lovable.app.
45
Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum
Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.
Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.
55
47
30
55
42
42
30
30
30
60
55
30
55
55
30
55
60
55
30
30
30
42
30
55
30
42
30
30
30
30
42
55
42
42