WeedHack MaaS Infostealer — Trojanized Minecraft Mods/Clients via YouTube + SEO Poisoning, 36-Browser & Crypto-Wallet Credential Theft with Paid RAT Tier (CVE-N/A)
WeedHack MaaS Infostealer (TL-2026-0665), also tracked as WeedHack Stealer, is a high-severity malware campaign, first published 2026-06-02. It is attributed to WeedHack Operators with low confidence, affects Mojang / Microsoft Minecraft Java Edition (players running third-party, maps to 32 MITRE ATT&CK techniques (T1005, T1027, T1027.002), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-0665
- Threat ID
- TL-2026-0665
- Also known as
- WeedHack Stealer, Spyware.weedhack, WeedHack MaaS
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-02
- Last reviewed
- 2026-06-02
- Attribution
- WeedHack Operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- gaming, consumer, cryptocurrency, individuals
- Target regions
- North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in WeedHack MaaS Infostealer
Malware and tooling: Spyware.weedhack, WeedHack, Ethereum JSON-RPC dead-drop (selector 0xce6d41de via eth.llamarpc.com), PureHVNC / PureLogs
WeedHack is a clear-net malware-as-a-service (MaaS) infostealer targeting Minecraft players, distributed as trojanized Fabric mods/clients/cheats promoted via YouTube and SEO poisoning. McAfee Labs telemetry counts 116,464 infections since January 2026 (2,000-3,000/day) across 3,820+ malicious JARs and 240+ URLs. A free tier steals Minecraft session IDs, cookies and saved passwords from 36+ browsers, 56 crypto browser extensions, 12 desktop wallets, and Discord/Steam/Telegram credentials; a $5/mo (or $24.99 lifetime) tier adds a full RAT with keylogging, webcam, screen share, remote shell and file management.
How WeedHack MaaS Infostealer works
WeedHack is a malware-as-a-service infostealer-plus-RAT platform aimed squarely at the Minecraft modding community. Unlike most infostealers it is hosted on the clear net with an open free tier, lowering the barrier to entry for unskilled operators. Customers receive a web dashboard (seller panel at weedhack.cy) with a victim overview, per-system profiles keyed by buyer UUID, stolen-data browsing, and a payload builder that produces trojanized JARs for Minecraft Java versions 1.21.0 through 1.21.10. McAfee Labs researcher Aayush Tyagi attributes 116,464 infections since January 2026, averaging 2,000-3,000 per day, delivered through 3,820+ unique malicious JAR files across 240+ distribution URLs. Victims concentrate in the United States, Germany, India, the United Kingdom, and Italy.
Distribution relies on social engineering rather than exploitation. Operators publish YouTube videos (some voice-narrated, 7,500+ views) demonstrating popular Minecraft clients with download links in descriptions and comments, and poison search results for legitimate open-source client names including Meteor, Radium, Wurst, Aristois, LiquidBounce, Impact, Future, Inertia, Cornos, WWE, 3arthh4ck, Salhack, Phobos and Gamesense. Fake distribution sites impersonate real projects (e.g. Skytils) and even link the genuine GitHub repository and Discord server to manufacture legitimacy — effective because many targeted clients only maintain GitHub pages, not official websites.
The payload is a multi-stage Java/Fabric mod chain. Stage 1 is a loader (mod.jar ~500KB in v1; the hardened NewMod.jar ~1.5MB in v2 adds JNIC native obfuscation and an Ethereum JSON-RPC blockchain C2 fallback) whose onInitialize() entry point in me/mclauncher/LoaderClient extracts the Minecraft session token immediately via MinecraftClient.getInstance().getSession(). Stage 1 pulls Stage 2 (module.jar ~2MB), the information stealer, which harvests cookies and DPAPI-decrypted passwords from 36+ Chromium/Gecko browsers (Chrome, Edge, Brave, Opera/OperaGX, Vivaldi, Yandex, Chromium, Thorium, 7Star, CentBrowser, Chedot, Kometa and more), 56 browser-extension crypto wallets (MetaMask, Phantom, Coinbase, Trust Wallet, Exodus Web3, Ronin, Keplr, Solflare, etc.), 12 desktop wallets (Exodus, Atomic, Electrum, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Ethereum), Discord tokens (encrypted/legacy/browser), Telegram tdata, and five Minecraft launchers (Lunar accounts.json, Essential microsoft_accounts.json, Feather account.txt, Modrinth app.db, vanilla servers.dat). It also captures screenshots and recursively searches for files matching keywords such as password, seed, wallet, crypto, 2fa and backup.
Premium buyers receive Stage 3 (Component.jar), a Java RAT providing a jnativehook-based real-time keylogger over Socket.IO, 25 FPS webcam capture and WebP screen share over WebSocket, a Runtime.exec()/ProcessBuilder remote shell, java.awt.Robot keyboard/mouse input injection, and a directory/file browser supporting upload and download. Persistence is handled by SecurityManager.jar, which installs into %APPDATA%\Microsoft\SecurityUpdates\, drops Updater.vbs, registers a HIGHEST-runlevel ONLOGON scheduled task named JavaSecurityUpdater, writes an HKCU Run key, adds a Windows Defender exclusion for C:\Users via hidden PowerShell (Add-MpPreference, Defender Event ID 5007), and obtains elevation through an ElevationHelper runas/CMSTPLUA UAC bypass. A February 2026 update added a secondary PureHVNC/PureLogs backdoor (Pjibf.exe, .NET Reactor packed) executed after UAC elevation via elevator.jar, beaconing to 45.141.119.34:50169 and WebSocket remotev2.whreceive.ru/ws/client. McAfee notes the operator community runs through a Telegram channel of 800+ members, and that many buyers appear to be teenagers and young adults who use the RAT tier to harass and cyberbully victims.
MITRE ATT&CK techniques used in TL-2026-0665
Collection
T1005 Data from Local System; T1113 Screen Capture; T1125 Video Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1056.001 Input Capture: Keylogging; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1573.002 Encrypted Channel: Asymmetric Cryptography
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery
Initial Access
Privilege Escalation
T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1585 Establish Accounts; T1587.001 Develop Capabilities: Malware; T1608.006 Stage Capabilities: SEO Poisoning
defense-impairment
Affected products and versions in WeedHack MaaS Infostealer
- Mojang / Microsoft — Minecraft Java Edition (players running third-party Fabric mods/clients)
Vulnerable versions: 1.21.0 through 1.21.10 (payload-builder targeted) - Multiple — Windows endpoints with Chromium/Gecko browsers, crypto wallets, Discord/Steam/Telegram
Vulnerable versions: Windows (all supported)
Remediation for WeedHack MaaS Infostealer
Immediate actions
- Block C2 domains receiver.cy, whreceive.ru, whreceiver.ru, remotev2.whreceive.ru, huehnchenfarm.ru, marsalek.cy, marsalek.cy and seller panel weedhack.cy at DNS/perimeter
- Block C2 IP 45.141.119.34 (incl. port 50169) at perimeter firewall
- Hunt for scheduled task 'JavaSecurityUpdater' and folder %APPDATA%\Microsoft\SecurityUpdates on endpoints
- Audit Windows Defender exclusions for an unexpected 'C:\Users' ExclusionPath (Defender Event ID 5007)
- Force-reset Minecraft/Microsoft, Discord, Steam, Telegram passwords and revoke sessions for any user who installed third-party Minecraft mods/clients
- Treat any crypto wallet seed phrases on infected hosts as compromised and migrate funds to fresh wallets
Workarounds
- Install Minecraft mods only from official project GitHub releases or Modrinth/CurseForge, never from YouTube links or search ads
- Verify JAR publisher and hash before execution; avoid clients distributed only via third-party portals
- Run the open-source Weedhack-Remover tool to delete persistence (JavaSecurityUpdater task, SecurityUpdates folder, Defender exclusion)
Longer-term hardening
- Deploy EDR with behavioral detection for java.exe/javaw.exe spawning powershell.exe, schtasks.exe and cmd.exe
- Restrict execution of untrusted JAR files via application allowlisting (WDAC/AppLocker)
- User awareness training on SEO-poisoned mod sites and YouTube-sourced game cheats
- Monitor for Add-MpPreference Defender tampering and HKCU Run-key persistence
Weaknesses (CWE) in WeedHack MaaS Infostealer
CWE-506, CWE-829, CWE-507
Timeline of WeedHack MaaS Infostealer
- WeedHack MaaS campaign begins distributing trojanized Minecraft mods/clients; McAfee telemetry first registers infections (January 2026).
- v2 update adds JNIC native obfuscation, Ethereum JSON-RPC blockchain C2 fallback, CMSTPLUA UAC bypass, and a secondary PureHVNC/PureLogs backdoor (Pjibf.exe) with new C2 domains (whreceive.ru, huehnchenfarm.ru, marsalek.cy).
- Russian-language outlets report WeedHack Minecraft mods stealing Telegram and crypto-wallet data from local victims.
- Threadlinqs Intelligence ingests WeedHack as TL-2026-0665; status ACTIVE, ongoing 2,000-3,000 infections/day.
- Independent technical analysis (0xresetti) and an open-source Weedhack-Remover tool publish detailed IOCs and three-stage architecture breakdown.
- McAfee Labs (Aayush Tyagi) publishes research; BleepingComputer/CyberInsider report 116,464 infections since January 2026 across 3,820+ JARs and 240+ URLs.
Sources cited for WeedHack MaaS Infostealer
- Over 116,000 Minecraft systems infected in WeedHack malware campaign
- Game Over: WeedHack - The Rise of Minecraft Malware-as-a-Service Campaigns (McAfee Labs, Aayush Tyagi)
- WeedHack Minecraft malware campaign infects over 116,000 PCs
- Weedhack Stealer - Technical Analysis (0xresetti)
- Weedhack-Remover — removal tool
- Malwarebytes Threat Alert | Spyware.weedhack
- Minecraft malware campaign reportedly infected over 116,000 players (Digital Trends)
Threats related to WeedHack MaaS Infostealer
- WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient)
- Millenium RAT v4: C++ Rewrite Fuels Y2K Operators' MaaS Campaign (62,289 Devices, 160+ Countries)
- Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations
- Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution
- DBatLoader (ModiLoader/NatsoLoader): Delphi-Compiled Windows Loader Using Layered Anti-Analysis, Mock-Trusted-Directory UAC Bypass, and DLL Side-Loading to Deliver Remcos, FormBook, NetWire and Warzone
- GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET Bitmap-Steganography Infection Chain
Detection coverage for TL-2026-0665
As of 2026-06-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0665 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.