McAfee reports the Minecraft targeted MaaS operation is still pushing credential stealing payloads through fake client sites and Discord links despite its main C2 server being taken down in July.
If you have been searching for free versions of paid Minecraft clients or mods lately there is a good chance the top result was a trap. Cybersecurity firm McAfee has documented a persistent Malware as a Service campaign called WeedHack that continues to compromise players even after its primary infrastructure was disrupted.
The operation which began in January 2026 specializes in weaponized Minecraft tools. Affiliates create near perfect copies of legitimate projects including Glazed Client Radium Client SeedCrackerX and Nova Client. These fake sites copy branding screenshots FAQs and even support pages then offer the paid software for free.
How the campaign survives
After the original command and control server and operator dashboard were taken down in July the attackers simply pivoted. Nearly half of all distribution links now point to Discord servers one of which has over 1900 members. The rest use MediaFire GitHub and Dropbox. SEO poisoning ensures the malicious domains appear before the real ones in Google.
- Over 116464 infections tied to the campaign so far
- More than 3820 unique malicious JAR files identified
- 240 plus distribution URLs tracked
- Credential theft and remote access trojan capabilities confirmed
McAfee researchers noted the malware uses advanced techniques like EtherHiding on Ethereum to fetch updated C2 addresses and RSA signed responses to avoid interference. Even with the main backend impaired the affiliate model lets new operators keep pushing payloads.
The malware was marketed through an accessible operator dashboard and enabled affiliates to compromise gaming systems through weaponized mods cheats clients and utilities.
The report from McAfee Labs makes clear that search rankings Discord member counts or GitHub links are no guarantee of safety. Players should stick to verified creators and official download channels.