WeedHack, LofyStealer and the Minecraft Mod Malware Wave of 2026: How It Works and How to Stay Safe

Imagine downloading what looks like Meteor Client or Wurst from a site at the top of Google. The video tutorial that pointed you there looks legit, and the jar even launches. Meanwhile your Minecraft session, Discord token, saved passwords and webcam belong to someone else. That is the business model of WeedHack, the biggest Minecraft-targeting malware operation ever documented, and it ran for months before anyone noticed.

• 116,464PCs infected by WeedHack, January to June 2026
• 2–3KNew WeedHack victims per day at its peak
• $5Starting monthly price to rent it, per reports
• 10+Fake client sites still live after the takedown

Why this wave is different

• It’s a product, not a lone hacker. WeedHack is malware-as-a-service. Customers get a web dashboard with their victims, stolen data and a payload builder for Minecraft 1.21.x, plus tutorials on spreading it.
• It hides inside real mods. The builder can inject the stealer into legitimate mod jars, so the mod still works while the theft happens in the background.
• It goes after cheat-client users. McAfee’s list of impersonated tools includes Meteor, Wurst, LiquidBounce, Aristois, Impact, Future, Inertia and others.
• It survived a takedown. Its command servers were disrupted in mid-2026, but by August McAfee found the distribution network still running, moved to Discord, MediaFire and AI-generated fake client sites that ranked high in Google.
• It spreads by USB too. About 9,000 infections came through USB drives and other removable media.

The campaigns that hit Minecraft players in 2026

LofyGang is a Brazilian cybercrime group that went quiet for more than three years before resurfacing with the Slinky lure, as The Hacker News reported. Researchers at Dark Atlas traced WeedHack’s roots to a private stealer called Majanito in late 2025, before it was rebranded and sold openly.

Malware on CurseForge and Modrinth: the October 2026 sweep

Official mod sites are safer than random download pages, but not clean. Between 20 and 24 October 2026, Modgrade, a site that scans Minecraft mods and plugins, reported 34 projects that were still online on CurseForge and Modrinth with malware inside. All of them have since been pulled.

• Utility mods that stole your login. Full Bright, TooManyTools and Slimagar on CurseForge sent players’ Minecraft sessions (and in Full Bright’s case, Discord tokens) to an outside server. Dungeons Extras also took saved browser passwords.
• Server plugins with miners. PGCVisibility, a Paper plugin on Modrinth, hid a cryptocurrency miner. SimpleHomePlugin carried code imitating bStats, a known sign of a plugin malware campaign.
• Clean first, poisoned later. On 27 October Modrinth removed six more small mods after a researcher noticed they fetched an “update” from an outside site. Modgrade found their 1.0.0 files clean. The 1.0.1 files installed a password-stealing browser extension.

That last trick is the one to remember: a mod can be fine when you first add it and turn bad in a later update. If you use small or new mods, check the mods folder after updates, not just once.

How to check yourself and stay safe

1. Download mods only from Modrinth or CurseForge, and clients only from the developer’s official site or GitHub. Type the address yourself rather than trusting a search ad, a top search result or a video description.
2. Treat “free” paid clients and cracked cheats as malware. They’re the main bait.
3. Be suspicious of files sent by friends, especially modpacks, launchers and .exe files, even from accounts you trust. Hacked friend accounts are how these campaigns spread.
4. Scan your PC if you installed third-party mods or clients this year, then change your Microsoft and Discord passwords from a clean device and sign out of all sessions.
5. Don’t keep passwords or cards saved in your browser on a machine you also use for testing mods.

For the Discord-side tricks, like fake verification links and friend DMs, see our Discord scams guide.

Server owners: backdoored plugins

Players aren’t the only targets. In May 2026, YouTuber KasaiSora reported that NameTags, a server plugin with around 15,000 Modrinth downloads, contained a hidden loader that fetched code from its developer’s site and could grant operator status to a specific account. According to that report, Modrinth removed the developer’s projects after reviewing the code, but bStats still showed roughly 900 servers running the plugin. Those figures come from the video and we could not verify them independently.

• Remove any plugin pulled from Modrinth or Hangar for malware, and don’t reinstall it from the developer’s own site.
• Check ops.json and your permissions plugin for accounts you don’t recognise.
• Prefer open-source plugins with an active history, and be wary of plugins that download code at runtime.

What’s next

The takedown didn’t stop WeedHack, because its operators run a distribution network, not a single site. As long as players hunt for free cheat clients, these campaigns will keep shipping new disguises. The safest rule hasn’t changed: if a download promises something for free that normally costs money, or gives you an edge you shouldn’t have, assume it costs you your account.