Despite command server takedowns the cheap Malware as a Service operation has switched to Discord and file hosts for distribution with over 6300 blocked attempts in the past month alone.
Minecraft players chasing performance mods or cracked clients are still walking into active malware traps. The WeedHack operation first documented with over 116000 infections has adapted after its primary infrastructure was taken down. According to fresh analysis it now relies heavily on Discord MediaFire and similar services to deliver payloads that impersonate popular Minecraft tools.
New Distribution Tactics
Researchers observed a clear pivot. Instead of compromised websites alone threat actors now abuse legitimate file hosts. Discord accounts for nearly half the links. The campaign spoofs legitimate projects offering paid clients for free to lure downloads. McAfee WebAdvisor has blocked more than 6300 attempts to reach these sites recently showing the volume remains high.
- Free tier steals passwords cookies Discord tokens crypto wallets and Minecraft session data
- Premium tier adds live screen webcam and file access for as little as $5 a month
- Uses Ethereum smart contracts in some variants to hide C2 servers
- Targets popular clients including Meteor LiquidBounce and Wurst clones
The operation functions as straightforward Malware as a Service. Operators run a dashboard where affiliates can manage victims. Early versions used SEO poisoned search results and polished YouTube videos to rank above real mod pages. That model has only been refined not retired.
Security firms recommend sticking exclusively to trusted sources like Modrinth or CurseForge verified listings. Enable Windows Defender keep your launcher updated and avoid anything promising free paid clients or cheats. If you have already downloaded suspicious mods from unverified links a full system scan and password reset across the board is the safest move.
Consequently we have observed a shift in tactics by these attackers. Threat actors have increasingly pivoted to file hosting services such as Discord to distribute WeedHack.
This is not theoretical. The numbers are real the methods are public and the targets are almost entirely young gamers. The Minecraft modding scene has always carried risk but affordable remote access trojans have made the consequences uglier than ever.
Other