McAfee Labs report published yesterday details how the infostealer campaign now uses AI generated fake client sites that rank at the top of Google searches for popular Minecraft tools delivering malware through Discord MediaFire and GitHub links.
Minecraft’s modding and custom client scene remains a prime target for malware operators. McAfee Labs dropped an update yesterday showing the WeedHack campaign has adapted and is still successfully luring players through SEO poisoned search results.
What Changed After the First Takedown
After McAfee disrupted the original command and control servers the operators regrouped. They now rely on an AI powered website creation platform to spin up fresh lookalike domains that mimic legitimate Minecraft projects. These sites copy branding feature lists and even GitHub style pages to appear trustworthy before pushing malicious downloads.
The numbers paint a clear picture. McAfee WebAdvisor blocked more than 6300 attempts in the past month alone. Almost 50 percent of the malicious URLs were hosted on Discord 23 percent on MediaFire and another 8 percent on GitHub. The original wave of this campaign had already hit over 116000 gamers before the first disruption.
How The Attack Actually Works
- Fake sites rank high for searches like popular client names or free versions of paid tools
- Pages imitate real project branding complete with feature lists and testimonials
- Downloads are pushed through common file hosts or direct Discord links
- The payload focuses on infostealers that target credentials session data and saved passwords
- Some variants disable security tools during installation
This is not theoretical. The report includes concrete indicators of compromise and examples of the landing pages that real players are hitting right now. The campaign is classified as Malware as a Service which means the operators are likely renting access to other criminals who then customize the stealers.
The Minecraft community has seen wave after wave of these threats because the ecosystem encourages third party tools. Until players get stricter about where they download from reports like this one will keep coming. The new AI assisted site generation makes blocking them even harder for search engines and security tools.
Other