# WeedHack MaaS Infostealer — Trojanized Minecraft Mods/Clients via YouTube + SEO Poisoning, 36-Browser & Crypto-Wallet Credential Theft with Paid RAT Tier (CVE-N/A)

> WeedHack is a clear-net malware-as-a-service (MaaS) infostealer targeting Minecraft players, distributed as trojanized Fabric mods/clients/cheats promoted via YouTube and SEO poisoning. McAfee Labs telemetry counts 116,464 infections since January 2026 (2,000-3,000/day) across 3,820+ malicious JARs and 240+ URLs. A free tier steals Minecraft session IDs, cookies and saved passwords from 36+ browsers, 56 crypto browser extensions, 12 desktop wallets, and Discord/Steam/Telegram credentials; a $5/mo (or $24.99 lifetime) tier adds a full RAT with keylogging, webcam, screen share, remote shell and file management.

- **Published:** 2026-06-02T00:00:00Z
- **Last reviewed:** 2026-06-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0665
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-weedhack-maas-infostealer-tl-2026-0665.webp?v=64e31867 (Threadlinqs threat intel: WeedHack Minecraft Mod Infostealer: Detection & IOCs (TL-2026-0665) — High severity, 33 IOCs, 9 detection rules.)
- **ID:** TL-2026-0665
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** WeedHack Operators
- **Detections:** 9 (1 shown free below) · **IOCs:** 33 (3 shown free below)

## Description

WeedHack is a malware-as-a-service infostealer-plus-RAT platform aimed squarely at the Minecraft modding community. Unlike most infostealers it is hosted on the clear net with an open free tier, lowering the barrier to entry for unskilled operators. Customers receive a web dashboard (seller panel at weedhack.cy) with a victim overview, per-system profiles keyed by buyer UUID, stolen-data browsing, and a payload builder that produces trojanized JARs for Minecraft Java versions 1.21.0 through 1.21.10. McAfee Labs researcher Aayush Tyagi attributes 116,464 infections since January 2026, averaging 2,000-3,000 per day, delivered through 3,820+ unique malicious JAR files across 240+ distribution URLs. Victims concentrate in the United States, Germany, India, the United Kingdom, and Italy.

Distribution relies on social engineering rather than exploitation. Operators publish YouTube videos (some voice-narrated, 7,500+ views) demonstrating popular Minecraft clients with download links in descriptions and comments, and poison search results for legitimate open-source client names including Meteor, Radium, Wurst, Aristois, LiquidBounce, Impact, Future, Inertia, Cornos, WWE, 3arthh4ck, Salhack, Phobos and Gamesense. Fake distribution sites impersonate real projects (e.g. Skytils) and even link the genuine GitHub repository and Discord server to manufacture legitimacy — effective because many targeted clients only maintain GitHub pages, not official websites.

The payload is a multi-stage Java/Fabric mod chain. Stage 1 is a loader (mod.jar ~500KB in v1; the hardened NewMod.jar ~1.5MB in v2 adds JNIC native obfuscation and an Ethereum JSON-RPC blockchain C2 fallback) whose onInitialize() entry point in me/mclauncher/LoaderClient extracts the Minecraft session token immediately via MinecraftClient.getInstance().getSession(). Stage 1 pulls Stage 2 (module.jar ~2MB), the information stealer, which harvests cookies and DPAPI-decrypted passwords from 36+ Chromium/Gecko browsers (Chrome, Edge, Brave, Opera/OperaGX, Vivaldi, Yandex, Chromium, Thorium, 7Star, CentBrowser, Chedot, Kometa and more), 56 browser-extension crypto wallets (MetaMask, Phantom, Coinbase, Trust Wallet, Exodus Web3, Ronin, Keplr, Solflare, etc.), 12 desktop wallets (Exodus, Atomic, Electrum, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Ethereum), Discord tokens (encrypted/legacy/browser), Telegram tdata, and five Minecraft launchers (Lunar accounts.json, Essential microsoft_accounts.json, Feather account.txt, Modrinth app.db, vanilla servers.dat). It also captures screenshots and recursively searches for files matching keywords such as password, seed, wallet, crypto, 2fa and backup.

Premium buyers receive Stage 3 (Component.jar), a Java RAT providing a jnativehook-based real-time keylogger over Socket.IO, 25 FPS webcam capture and WebP screen share over WebSocket, a Runtime.exec()/ProcessBuilder remote shell, java.awt.Robot keyboard/mouse input injection, and a directory/file browser supporting upload and download. Persistence is handled by SecurityManager.jar, which installs into %APPDATA%\Microsoft\SecurityUpdates\, drops Updater.vbs, registers a HIGHEST-runlevel ONLOGON scheduled task named JavaSecurityUpdater, writes an HKCU Run key, adds a Windows Defender exclusion for C:\Users via hidden PowerShell (Add-MpPreference, Defender Event ID 5007), and obtains elevation through an ElevationHelper runas/CMSTPLUA UAC bypass. A February 2026 update added a secondary PureHVNC/PureLogs backdoor (Pjibf.exe, .NET Reactor packed) executed after UAC elevation via elevator.jar, beaconing to 45.141.119.34:50169 and WebSocket remotev2.whreceive.ru/ws/client. McAfee notes the operator community runs through a Telegram channel of 800+ members, and that many buyers appear to be teenagers and young adults who use the RAT tier to harass and cyberbully victims.

## MITRE ATT&CK

- T1587.001 Develop Capabilities: Malware
- T1583.001 Acquire Infrastructure: Domains
- T1608.006 Stage Capabilities: SEO Poisoning
- T1585 Establish Accounts
- T1189 Drive-by Compromise
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1027.002 Obfuscated Files or Information: Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1056.001 Input Capture: Keylogging
- T1217 Browser Information Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Dead Drop Resolver
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WeedHack Fabric Loader Execution & Minecraft Session-Token Theft — Exploitation Phase** (`TL-2026-0665-SPL-001`)

WeedHack Fabric Loader Execution & Minecraft Session-Token Theft — grounded in WeedHack TL-2026-0665 TTPs (McAfee Labs / 0xresetti).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1539, T1059.001, T1036.005
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\javaw.exe" OR Image="*\\java.exe")
| eval is_mod_chain=if(match(CommandLine,"(?i)(\\\\mod\.jar|\\\\NewMod\.jar|\\\\module\.jar|\\\\Component\.jar|\.minecraft\\\\mods|fabric|me[\\/]mclauncher[\\/]LoaderClient)"),1,0)
| eval susp_child=if(match(CommandLine,"(?i)(powershell|schtasks|wscript\.exe|cmd\.exe|Add-MpPreference)"),1,0)
``` WeedHack Stage-1 loader: trojanized Fabric JAR launched by the Minecraft Java runtime,
   which immediately extracts the MC session token via MinecraftClient.getInstance().getSession() ```
| where is_mod_chain=1 OR susp_child=1
| stats count values(CommandLine) as command_lines values(ParentImage) as parent_image
  values(Image) as image min(_time) as first_seen by host, User
| where count > 0
| convert ctime(first_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe") or FileName in~ ("java.exe","javaw.exe")
| where ProcessCommandLine has_any ("mod.jar","NewMod.jar","module.jar","Component.jar",".minecraft\\mods","fabric","me/mclauncher/LoaderClient")
   or ProcessCommandLine has_any ("Add-MpPreference","schtasks","Updater.vbs")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc
```

### Sigma

```yaml
title: WeedHack Stage-1 Fabric Loader Execution and Minecraft Session-Token Theft
id: 6f3a1c8e-2b41-4d9a-9c11-0a55e1d77a01
status: experimental
description: Detects execution of a trojanized WeedHack Fabric mod/loader JAR (mod.jar / NewMod.jar) by the Minecraft Java runtime, whose onInitialize() in me/mclauncher/LoaderClient steals the Minecraft session token and stages later infostealer/RAT modules.
references:
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-as-a-service-campaign-research/
    - https://0xresetti.github.io/weedhack.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/02
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1204.002
    - attack.credential_access
    - attack.t1539
logsource:
    product: windows
    category: process_creation
detection:
    selection_runtime:
        Image|endswith:
            - '\java.exe'
            - '\javaw.exe'
    selection_artifacts:
        CommandLine|contains:
            - 'mod.jar'
            - 'NewMod.jar'
            - 'module.jar'
            - 'Component.jar'
            - '.minecraft\mods'
            - 'me/mclauncher/LoaderClient'
    condition: selection_runtime and selection_artifacts
falsepositives:
    - Legitimate Fabric mods named generically (mod.jar) loaded from official sources
level: high
```

**Known false positives:**

- Legitimate Fabric mods generically named mod.jar/module.jar loaded from official Modrinth/CurseForge sources
- Developer machines compiling/testing Minecraft mods

**Tuning notes:** Baseline normal java.exe/javaw.exe command lines for your Minecraft fleet; alert on the susp_child branch first (highest fidelity) and allowlist known-good mod paths.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- WeedHack Java Runtime Spawning Persistence/Evasion Children — Exploitation Phase (locked: unlock with TL Creds)
- WeedHack AVHelper Defender Exclusion via Hidden PowerShell (Event 5007) — Post-Exploitation Phase (locked: unlock with TL Creds)
- WeedHack PureHVNC Backdoor & WebSocket C2 Network Activity — C2/Lateral Movement Phase (locked: unlock with TL Creds)
- WeedHack Trojanized JAR Dropped to Minecraft Mods Folder — Exploitation Phase (locked: unlock with TL Creds)
- WeedHack UAC Bypass via [indicator] & CMSTPLUA — Post-Exploitation Phase (locked: unlock with TL Creds)
- WeedHack Ethereum JSON-RPC Blockchain Dead-Drop C2 — C2/Lateral Movement Phase (locked: unlock with TL Creds)
- WeedHack JavaSecurityUpdater Persistence (Scheduled Task + Run Key) — Post-Exploitation Phase (locked: unlock with TL Creds)
- WeedHack C2 Beacon & Ethereum Dead-Drop Resolution — C2/Lateral Movement Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 33)

Defanged, TLP:CLEAR.

- IP address: `45.141.119[.]34`
- Domain: `receiver[.]cy`
- Domain: `whreceive[.]ru`

Full set of 33 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Over 116,000 Minecraft systems infected in WeedHack malware campaign](https://www.bleepingcomputer.com/news/security/over-116-000-mincraft-systems-infected-in-weedhack-malware-campaign/)
- [Game Over: WeedHack - The Rise of Minecraft Malware-as-a-Service Campaigns (McAfee Labs, Aayush Tyagi)](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-as-a-service-campaign-research/)
- [WeedHack Minecraft malware campaign infects over 116,000 PCs](https://cyberinsider.com/weedhack-minecraft-malware-campaign-infects-over-116000-pcs/)
- [Weedhack Stealer - Technical Analysis (0xresetti)](https://0xresetti.github.io/weedhack.html)
- [Weedhack-Remover — removal tool](https://github.com/0xresetti/Weedhack-Remover)
- [Malwarebytes Threat Alert | Spyware.weedhack](https://www.malwarebytes.com/blog/detections/spyware-weedhack)
- [Minecraft malware campaign reportedly infected over 116,000 players (Digital Trends)](https://www.digitaltrends.com/gaming/minecraft-malware-campaign-reportedly-infected-over-116000-players/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0665