WeedHack MaaS Infostealer — Trojanized Minecraft Mods/Clients via YouTube + SEO Poisoning, 36-Browser & Crypto-Wallet Credential Theft with Paid RAT Tier (CVE-N/A)

Key facts for WeedHack MaaS infostealer

Detection coverage for WeedHack MaaS infostealer

As of 2026-06-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0665 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WeedHack Fabric Loader Execution & Minecraft Session-Token Theft — Exploitation Phase

WeedHack Fabric Loader Execution & Minecraft Session-Token Theft — grounded in WeedHack TL-2026-0665 TTPs (McAfee Labs / 0xresetti).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1539, T1059.001, T1036.005
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\javaw.exe" OR Image="*\\java.exe")
| eval is_mod_chain=if(match(CommandLine,"(?i)(\\\\mod\.jar|\\\\NewMod\.jar|\\\\module\.jar|\\\\Component\.jar|\.minecraft\\\\mods|fabric|me[\\/]mclauncher[\\/]LoaderClient)"),1,0)
| eval susp_child=if(match(CommandLine,"(?i)(powershell|schtasks|wscript\.exe|cmd\.exe|Add-MpPreference)"),1,0)
``` WeedHack Stage-1 loader: trojanized Fabric JAR launched by the Minecraft Java runtime,
   which immediately extracts the MC session token via MinecraftClient.getInstance().getSession() ```
| where is_mod_chain=1 OR susp_child=1
| stats count values(CommandLine) as command_lines values(ParentImage) as parent_image
  values(Image) as image min(_time) as first_seen by host, User
| where count > 0
| convert ctime(first_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe") or FileName in~ ("java.exe","javaw.exe")
| where ProcessCommandLine has_any ("mod.jar","NewMod.jar","module.jar","Component.jar",".minecraft\\mods","fabric","me/mclauncher/LoaderClient")
   or ProcessCommandLine has_any ("Add-MpPreference","schtasks","Updater.vbs")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc

Sigma

title: WeedHack Stage-1 Fabric Loader Execution and Minecraft Session-Token Theft
id: 6f3a1c8e-2b41-4d9a-9c11-0a55e1d77a01
status: experimental
description: Detects execution of a trojanized WeedHack Fabric mod/loader JAR (mod.jar / NewMod.jar) by the Minecraft Java runtime, whose onInitialize() in me/mclauncher/LoaderClient steals the Minecraft session token and stages later infostealer/RAT modules.
references:
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-as-a-service-campaign-research/
    - https://0xresetti.github.io/weedhack.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/02
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1204.002
    - attack.credential_access
    - attack.t1539
logsource:
    product: windows
    category: process_creation
detection:
    selection_runtime:
        Image|endswith:
            - '\java.exe'
            - '\javaw.exe'
    selection_artifacts:
        CommandLine|contains:
            - 'mod.jar'
            - 'NewMod.jar'
            - 'module.jar'
            - 'Component.jar'
            - '.minecraft\mods'
            - 'me/mclauncher/LoaderClient'
    condition: selection_runtime and selection_artifacts
falsepositives:
    - Legitimate Fabric mods named generically (mod.jar) loaded from official sources
level: high

Known false positives:

• Legitimate Fabric mods generically named mod.jar/module.jar loaded from official Modrinth/CurseForge sources
• Developer machines compiling/testing Minecraft mods

Tuning notes: Baseline normal java.exe/javaw.exe command lines for your Minecraft fleet; alert on the susp_child branch first (highest fidelity) and allowlist known-good mod paths.

• 🔒 WeedHack Java Runtime Spawning Persistence/Evasion Children — Exploitation Phase · unlock with TL Creds
• 🔒 WeedHack AVHelper Defender Exclusion via Hidden PowerShell (Event 5007) — Post-Exploitation Phase · unlock with TL Creds
• 🔒 WeedHack PureHVNC Backdoor & WebSocket C2 Network Activity — C2/Lateral Movement Phase · unlock with TL Creds
• 🔒 WeedHack Trojanized JAR Dropped to Minecraft Mods Folder — Exploitation Phase · unlock with TL Creds
• 🔒 WeedHack UAC Bypass via [indicator] & CMSTPLUA — Post-Exploitation Phase · unlock with TL Creds
• 🔒 WeedHack Ethereum JSON-RPC Blockchain Dead-Drop C2 — C2/Lateral Movement Phase · unlock with TL Creds
• 🔒 WeedHack JavaSecurityUpdater Persistence (Scheduled Task + Run Key) — Post-Exploitation Phase · unlock with TL Creds
• 🔒 WeedHack C2 Beacon & Ethereum Dead-Drop Resolution — C2/Lateral Movement Phase · unlock with TL Creds

Indicators of compromise for WeedHack MaaS infostealer

As of 2026-06-02, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-0665.

Sample indicators (3 of 33)

• IP address: 45.141.119[.]34
• Domain: receiver[.]cy
• Domain: whreceive[.]ru

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

How WeedHack MaaS infostealer works

A free tier steals Minecraft session IDs, cookies and saved passwords from 36+ browsers, 56 crypto browser extensions, 12 desktop wallets, and Discord/Steam/Telegram credentials; a $5/mo (or $24.99 lifetime) tier adds a full RAT with keylogging, webcam, screen share, remote shell and file management.

WeedHack is a malware-as-a-service infostealer-plus-RAT platform aimed squarely at the Minecraft modding community. Unlike most infostealers it is hosted on the clear net with an open free tier, lowering the barrier to entry for unskilled operators. Customers receive a web dashboard (seller panel at weedhack.cy) with a victim overview, per-system profiles keyed by buyer UUID, stolen-data browsing, and a payload builder that produces trojanized JARs for Minecraft Java versions 1.21.0 through 1.21.10. McAfee Labs researcher Aayush Tyagi attributes 116,464 infections since January 2026, averaging 2,000-3,000 per day, delivered through 3,820+ unique malicious JAR files across 240+ distribution URLs. Victims concentrate in the United States, Germany, India, the United Kingdom, and Italy.

Distribution relies on social engineering rather than exploitation. Operators publish YouTube videos (some voice-narrated, 7,500+ views) demonstrating popular Minecraft clients with download links in descriptions and comments, and poison search results for legitimate open-source client names including Meteor, Radium, Wurst, Aristois, LiquidBounce, Impact, Future, Inertia, Cornos, WWE, 3arthh4ck, Salhack, Phobos and Gamesense. Fake distribution sites impersonate real projects (e.g. Skytils) and even link the genuine GitHub repository and Discord server to manufacture legitimacy — effective because many targeted clients only maintain GitHub pages, not official websites.

The payload is a multi-stage Java/Fabric mod chain. Stage 1 is a loader (mod.jar ~500KB in v1; the hardened NewMod.jar ~1.5MB in v2 adds JNIC native obfuscation and an Ethereum JSON-RPC blockchain C2 fallback) whose onInitialize() entry point in me/mclauncher/LoaderClient extracts the Minecraft session token immediately via MinecraftClient.getInstance().getSession(). Stage 1 pulls Stage 2 (module.jar ~2MB), the information stealer, which harvests cookies and DPAPI-decrypted passwords from 36+ Chromium/Gecko browsers (Chrome, Edge, Brave, Opera/OperaGX, Vivaldi, Yandex, Chromium, Thorium, 7Star, CentBrowser, Chedot, Kometa and more), 56 browser-extension crypto wallets (MetaMask, Phantom, Coinbase, Trust Wallet, Exodus Web3, Ronin, Keplr, Solflare, etc.), 12 desktop wallets (Exodus, Atomic, Electrum, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Ethereum), Discord tokens (encrypted/legacy/browser), Telegram tdata, and five Minecraft launchers (Lunar accounts.json, Essential microsoft_accounts.json, Feather account.txt, Modrinth app.db, vanilla servers.dat). It also captures screenshots and recursively searches for files matching keywords such as password, seed, wallet, crypto, 2fa and backup.

Premium buyers receive Stage 3 (Component.jar), a Java RAT providing a jnativehook-based real-time keylogger over Socket.IO, 25 FPS webcam capture and WebP screen share over WebSocket, a Runtime.exec()/ProcessBuilder remote shell, java.awt.Robot keyboard/mouse input injection, and a directory/file browser supporting upload and download. Persistence is handled by SecurityManager.jar, which installs into %APPDATA%\Microsoft\SecurityUpdates\, drops Updater.vbs, registers a HIGHEST-runlevel ONLOGON scheduled task named JavaSecurityUpdater, writes an HKCU Run key, adds a Windows Defender exclusion for C:\Users via hidden PowerShell (Add-MpPreference, Defender Event ID 5007), and obtains elevation through an ElevationHelper runas/CMSTPLUA UAC bypass. A February 2026 update added a secondary PureHVNC/PureLogs backdoor (Pjibf.exe, .NET Reactor packed) executed after UAC elevation via elevator.jar, beaconing to 45.141.119.34:50169 and WebSocket remotev2.whreceive.ru/ws/client. McAfee notes the operator community runs through a Telegram channel of 800+ members, and that many buyers appear to be teenagers and young adults who use the RAT tier to harass and cyberbully victims.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1125 Video Capture

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1056.001 Input Capture: Keylogging; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1573.002 Encrypted Channel: Asymmetric Cryptography

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery

Initial Access

T1189 Drive-by Compromise

Privilege Escalation

T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1585 Establish Accounts; T1587.001 Develop Capabilities: Malware; T1608.006 Stage Capabilities: SEO Poisoning

defense-impairment

T1685 Disable or Modify Tools

Remediation for WeedHack MaaS infostealer

Immediate actions

• Block C2 domains receiver.cy, whreceive.ru, whreceiver.ru, remotev2.whreceive.ru, huehnchenfarm.ru, marsalek.cy, marsalek.cy and seller panel weedhack.cy at DNS/perimeter
• Block C2 IP 45.141.119.34 (incl. port 50169) at perimeter firewall
• Hunt for scheduled task 'JavaSecurityUpdater' and folder %APPDATA%\Microsoft\SecurityUpdates on endpoints
• Audit Windows Defender exclusions for an unexpected 'C:\Users' ExclusionPath (Defender Event ID 5007)
• Force-reset Minecraft/Microsoft, Discord, Steam, Telegram passwords and revoke sessions for any user who installed third-party Minecraft mods/clients
• Treat any crypto wallet seed phrases on infected hosts as compromised and migrate funds to fresh wallets

Workarounds

• Install Minecraft mods only from official project GitHub releases or Modrinth/CurseForge, never from YouTube links or search ads
• Verify JAR publisher and hash before execution; avoid clients distributed only via third-party portals
• Run the open-source Weedhack-Remover tool to delete persistence (JavaSecurityUpdater task, SecurityUpdates folder, Defender exclusion)

Longer-term hardening

• Deploy EDR with behavioral detection for java.exe/javaw.exe spawning powershell.exe, schtasks.exe and cmd.exe
• Restrict execution of untrusted JAR files via application allowlisting (WDAC/AppLocker)
• User awareness training on SEO-poisoned mod sites and YouTube-sourced game cheats
• Monitor for Add-MpPreference Defender tampering and HKCU Run-key persistence

Affected and fixed versions

• Mojang / Microsoft — Minecraft Java Edition (players running third-party Fabric mods/clients)
  Vulnerable versions: 1.21.0 through 1.21.10 (payload-builder targeted)
• Multiple — Windows endpoints with Chromium/Gecko browsers, crypto wallets, Discord/Steam/Telegram
  Vulnerable versions: Windows (all supported)

Timeline of WeedHack MaaS infostealer

• 2026-01-01 locked-ioc-31 MaaS campaign begins distributing trojanized Minecraft mods/clients; McAfee telemetry first registers infections (January 2026).
• 2026-02-01 v2 update adds JNIC native obfuscation, Ethereum JSON-RPC blockchain C2 fallback, CMSTPLUA UAC bypass, and a secondary PureHVNC/PureLogs backdoor (locked-ioc-30) with new C2 domains (locked-ioc-22, locked-ioc-17, locked-ioc-25).
• 2026-04-22 Russian-language outlets report locked-ioc-31 Minecraft mods stealing Telegram and crypto-wallet data from local victims.
• 2026-06-02 Threadlinqs Intelligence ingests locked-ioc-31 as TL-2026-0665; status ACTIVE, ongoing 2,000-3,000 infections/day.
• 2026-06-02 Independent technical analysis (0xresetti) and an open-source Weedhack-Remover tool publish detailed IOCs and three-stage architecture breakdown.
• 2026-06-02 McAfee Labs (Aayush Tyagi) publishes research; BleepingComputer/CyberInsider report 116,464 infections since January 2026 across 3,820+ JARs and 240+ URLs.

Sources cited for WeedHack MaaS infostealer

• Game Over: WeedHack - The Rise of Minecraft Malware-as-a-Service Campaigns (McAfee Labs, Aayush Tyagi) mcafee.com · Vendor report · 2026-06-02
• Weedhack Stealer - Technical Analysis (0xresetti) 0xresetti.github.io · Research · 2026-06-02
• Malwarebytes Threat Alert | Spyware.weedhack malwarebytes.com · Vendor report · 2026-06-02
• Weedhack-Remover — removal tool GitHub · Code repository · 2026-06-02
• Over 116,000 Minecraft systems infected in WeedHack malware campaign BleepingComputer · News · 2026-06-02
• WeedHack Minecraft malware campaign infects over 116,000 PCs cyberinsider.com · News · 2026-06-02
• Minecraft malware campaign reportedly infected over 116,000 players (Digital Trends) digitaltrends.com · News · 2026-06-02

Threats related to WeedHack MaaS infostealer

• WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient)
• Millenium RAT v4: C++ Rewrite Fuels Y2K Operators' MaaS Campaign (62,289 Devices, 160+ Countries)
• Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations
• Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution
• DBatLoader (ModiLoader/NatsoLoader): Delphi-Compiled Windows Loader Using Layered Anti-Analysis, Mock-Trusted-Directory UAC Bypass, and DLL Side-Loading to Deliver Remcos, FormBook, NetWire and Warzone

Related coverage of this activity

• TONResolver Booking.com phishing RAT
• Remcos GST refund phishing
• OpenShield Corepack VPN lure
• OpenClaw Hologram fake installers
• Mistic backdoor MpExtMs sideload

Previous and next in malware

• WordPress Malware Abuses Steam Community Profiles for C2 — Unicode Steganography, AES-256-CTR Payloads, Cookie-Auth PHP Backdoor + JS Injection (~1,980 Sites, GoDaddy) Previous report
• Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System Compromise Next report