* Originally in: SF_Gaming

Weedhack malware campaign infects 116,000 mod-hungry Minecraft players
systems through SEO poisoning and YouTube

Date:
Wed, 03 Jun 2026 14:25:00 +0000

Fake mods and clients are being advertised on YouTube and used to deploy backdoors and infostealers: Cybercriminals are using YouTube to
disseminate malware that targets Minecraft users and takes full control over their computers .

In January this year, security researchers McAfee Labs spotted a new
malicious campaign dubbed Weedhack. In the campaign, the malicious actors created countless YouTube channels and standalone websites, through which
they promoted links to Minecraft clients and mods. With the help of Weedhack (apparently an enterprise-grade dashboard that also allows crooks to inject the malware into legitimate Minecraft mods), they created poisoned mods and clients which delivered a .JAR file called DonutDupe.jar.

This is a Java ARchive package format
used in the Java ecosystem to bundle multiple files into a single archive. This file starts a chain reaction that results in Windows Defender being disabled, system information collected, and two additional payloads dropped, which establish persistence and enable remote access.

McAfee said the campaign accumulated a total of 116,464 hits, averaging approximately 2000 to 3,000 hits per day. Most of them are located in the US, with other notable mentions including Germany, India, the UK, Italy, Vietnam, Canada, Norway, Sweden, Finland, and Spain.

McAfee describes Weedhack as a Minecraft-focused Malware-as-a-service (MaaS). The custom payloads target versions 1.21.0 to 1.21.11 of the game, while the dashboard allows malicious actors to view stolen credentials and exfiltrated system information in a centralized manner. The MaaS is apparently being offered in Telegram channels in two tiers - free and paid, and while the free version comes with plenty of features (screenshot grabber, file exfiltrator), the paid one ($4.99 a month) offers webcam access, keylogging, and reverse shell execution.

One of the key features that makes Weedhack unique is that it is hosted on
the clear net and provides access to sophisticated malware for free," McAfees researchers explained. "This difference in cost and ease of access with detailed tutorials on how to use the malware significantly reduces the
barrier to entry for prospective customers. Furthermore, its ability to steal Minecraft accounts attracts a younger audience. Both of these factors complement each other and make the campaign much more lethal."

Via The Hacker News

Link to news story: https://www.techradar.com/pro/security/weedhack-malware-campaign-infects-116-0 00-mod-hungry-minecraft-players-systems-through-seo-poisoning-and-youtube

$$
--- MultiMail/DOS
* Origin: Capitol City Hub (1:2320/105)