McAfee reports the campaign is still live in August with over 6300 blocked attempts in the past month as attackers pivot to Discord file shares and fake client sites to deliver info stealing malware.
Minecraft players continue to get burned by WeedHack. According to a new McAfee Labs update the SEO poisoned campaign impersonating popular clients like Xenon is still very much alive one month after authorities disrupted the original command and control infrastructure.
Instead of their old dashboard and dedicated malicious sites the operators have moved heavily to Discord which now accounts for nearly half of all observed distribution links. MediaFire GitHub and Dropbox make up most of the rest while some fake Minecraft reseller pages offer paid cheats for free to lure victims.
What WeedHack Actually Does
- Steals Discord tokens and browser data
- Can access webcams and take screenshots
- Functions as a remote access trojan with MaaS affiliate features
- Over 3800 unique malicious JAR files tied to the campaign so far
The malware is not some amateur script. It was built as a service with an operator dashboard that lets affiliates customize payloads. McAfee previously linked it to more than 116000 infections before the July disruption. The fact that it is still generating thousands of blocks per month shows how resilient these operations have become.
Minecraft itself bears no blame here. The danger comes entirely from third party downloads. Official launcher versions from minecraft.net are safe. The moment you Google for alternate clients or free hacks you step into the minefield.
Consequently we have observed a shift in tactics by these attackers.
That shift has clearly worked for them. File hosting services lend an air of legitimacy that pure malicious domains lack. A Discord link or MediaFire download looks a lot less suspicious than some random .ru site.
What You Should Do
- Only download Minecraft from the official launcher or marketplace
- Avoid Google searches for clients mods or hacked versions
- Treat any Discord link offering free paid tools as malicious
- Keep Discord tokens protected and enable 2FA everywhere
- Use security software that blocks known malware domains
News