WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient)
WeedHack MaaS Campaign (TL-2026-0969), also tracked as WeedHack, is a critical-severity malware campaign, first published 2026-06-28. It is attributed to Majanito with medium confidence, affects Mojang / Microsoft Minecraft Java Edition (with Fabric mod loader), maps to 38 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-0969
- Threat ID
- TL-2026-0969
- Also known as
- WeedHack, LoaderClient, WeedHack MaaS, Majanito Stealer, WeedHack Stealer
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-28
- Last reviewed
- 2026-06-28
- Attribution
- Majanito
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- gaming, consumer, finance, cryptocurrency, education
- Target regions
- North America, Europe, Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in WeedHack MaaS Campaign
Malware and tooling: LoaderClient, PureLogs, JNIC v3.7.0
WeedHack is an active Malware-as-a-Service platform distributing LoaderClient — a multi-stage Java RAT — via trojanized Minecraft Fabric mods promoted through YouTube social engineering and SEO-poisoned portals. The campaign features a novel blockchain-based C2 mechanism (EtherHiding) where the current C2 URL is retrieved from Ethereum smart contract 0x1280a841Fbc1F883365d3C83122260E0b2995B74 and authenticated via an embedded RSA-2048 public key, making infrastructure takedown ineffective. As of June 2026 the campaign has compromised 116,000+ systems at a rate of 2,000–3,000 new infections daily, harvesting Microsoft OAuth tokens, browser credentials, cryptocurrency wallets, and deploying a full-featured RAT.
How WeedHack MaaS Campaign works
WeedHack is a Malware-as-a-Service (MaaS) platform created by the threat actor known as 'Majanito' — an evolution of their earlier standalone credential stealer tool of the same name created in late 2025. The platform provides 850+ registered operators with a JAR builder that generates malicious Minecraft Fabric mod files targeting Minecraft Java Edition versions 1.21.0–1.21.11 on Windows. Operators distribute the generated mods via YouTube videos (recorded with voice-over narration; individual videos achieving 7,500+ views), SEO-poisoned websites impersonating legitimate Minecraft mod repositories (Modrinth, CurseForge lookalikes), and GitHub repositories.
The infection chain is four-staged. Stage 1 (LoaderClient) is a malicious Fabric mod JAR. When Minecraft launches with the mod installed, or when the JAR is executed standalone, it decrypts its embedded strings using a custom 'decS' cipher (two interleaved integer arrays XOR-mixed with a substitution box and position-dependent bit rotation, constants k1=187, k2=67). It then harvests the victim's Minecraft session data — display name, UUID, and live Microsoft OAuth access token — and HTTP POSTs these to the operator's credential collection endpoint. Critically, the malware contains no hardcoded C2 domain. Instead it calls `eth_call` against 32 hardcoded public Ethereum JSON-RPC endpoints (Llamarpc, Publicnode, Tenderly, Flashbots, DRPC, and others) with function selector 0xce6d41de (keccak256 of `getText()`) against contract address 0x1280a841Fbc1F883365d3C83122260E0b2995B74. The contract returns an ABI-encoded string in the format `<C2_URL>|<RSA_SIGNATURE>`. The malware verifies the signature using an embedded RSA-2048 public key (SHA256withRSA) before trusting the URL. This EtherHiding mechanism defeats sinkholing: the blockchain is immutable, the RSA signature prevents third-party URL injection even if the contract owner key is revoked, and 32 redundant RPC endpoints survive any single-endpoint block.
Stage 2 (WeedHack Module) is downloaded entirely in-memory via ExtraClassLoader (no disk write for the JAR). It is compiled with JNIC v3.7.0, converting Java bytecode to native Windows DLLs (x86_64 and aarch64) embedded as LZMA-compressed .dat resources. Stage 2 disables SSL certificate validation, switches to DNS-over-HTTPS for network evasion, calls PowerShell hidden to add `C:\Users` to Windows Defender exclusions, and executes a CMSTP UAC bypass (spawning cmstp.exe with a .xdmf INF config) to gain elevated privileges. It then establishes persistence via three mechanisms: HKCU Run key, a scheduled task named JavaSecurityUpdater (ONLOGON, HIGHEST privilege), and a watchdog task JMonitoringTask (every 2 minutes). The full credential-stealer payload targets 36 browsers (Chrome, Edge, Brave, Opera, OperaGX, Vivaldi, Yandex, and 29 others), 56 browser-based cryptocurrency wallet extensions (MetaMask, Phantom, Coinbase, Trust Wallet, Exodus Web3, Ronin, Keplr, Solflare, and 48 others), 12 desktop cryptocurrency wallets, Discord tokens, Steam credentials, and Telegram tdata. It also searches for files containing keywords 'password', 'seed', 'wallet', 'crypto', '2fa', 'backup'. Specific Minecraft launcher data is targeted: Lunar Client accounts.json, Essential Mod microsoft_accounts.json, Feather Launcher account.txt (DPAPI+AES-GCM), Modrinth App app.db (SQLite), and numerous client mods (Meteor, Radium, Wurst, Aristois, LiquidBounce, Impact, Future, Inertia, Cornos, WWE, 3arthh4ck, Salhack, Phobos, Gamesense).
Stage 3 (Component RAT) is downloaded from `<C2>/files/jar/component`, versioned via `/api/component/lastModified`, and provides the premium-tier RAT: real-time keylogging via Socket.IO, webcam capture at 25 FPS, screen sharing at 720p (WebP @ 0.85 quality), remote shell via ProcessBuilder, file manager with upload/download, and keyboard/mouse injection via java.awt.Robot. All RAT communications use WebSocket (wss://) to remotev2.wh*.ru endpoints. Stage 4 is a developer-installed backdoor (Pjibf.exe — PureLogs/PureHVNC, obfuscated with NETReactor) that communicates with 45.141.119.34:50169 via RDP protocol and WebSocket to remotev2.whreceive.ru.
The MaaS platform offers a free tier (credential theft) and a premium tier ($5/month or $24.99 lifetime) for full RAT functionality. The operator dashboard (weedhack.to / weedhack.cy) provides a real-time leaderboard with 10-minute refresh, victim profiles with screenshots, IP addresses, and credentials, plus distribution tutorials, OPSEC guidance, and feature voting. McAfee Labs discovered the campaign and published a disclosure on June 3, 2026. As of late June 2026: 116,000+ unique compromised hosts, 2,000–3,000 new infections daily, 3,820+ unique malicious JAR files, 240+ active distribution URLs.
MITRE ATT&CK techniques used in TL-2026-0969
Collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1125 Video Capture
Discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1219 Remote Access Tools; T1568 Dynamic Resolution; T1573 Encrypted Channel
Initial Access
T1195 Supply Chain Compromise; T1566 Phishing
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in WeedHack MaaS Campaign
- Mojang / Microsoft — Minecraft Java Edition (with Fabric mod loader)
Vulnerable versions: 1.21.0; 1.21.1; 1.21.2; 1.21.3; 1.21.4; 1.21.5; 1.21.6; 1.21.7; 1.21.8; 1.21.9 - Microsoft — Windows (x86_64 and aarch64)
Vulnerable versions: Windows 10; Windows 11; Windows Server
Remediation for WeedHack MaaS Campaign
Immediate actions
- Block all WeedHack C2 domains at DNS and proxy: fucktermedfir.st, receiver.cy, weedhack.cy, weedhack.to, whnewreceive.ru, whreceive.ru, whreceiver.ru, marsalek.cy, huehnchenfarm.ru, remotev2.whpayment.ru, remotev2.whreceive.ru, telemetrydata.to
- Block IP 45.141.119.34 at perimeter firewall (PureLogs/PureHVNC backdoor C2)
- Hunt for scheduled tasks named JavaSecurityUpdater and JMonitoringTask — delete if found
- Hunt for HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries pointing to javaw.exe or RuntimeBroker.exe in %APPDATA%
- Remove any %APPDATA%\Roaming\RuntimeBroker.exe, %APPDATA%\Roaming\Microsoft\Tlmtry\Telemetry.exe, Updater.vbs artifacts
- Revoke and rotate all Microsoft accounts whose OAuth tokens may have been exfiltrated — force re-authentication
- Rotate all browser-stored credentials and cryptocurrency wallet seed phrases for affected users
- Block outbound eth_call JSON-RPC traffic from non-blockchain processes (javaw.exe, java.exe) at proxy/firewall
- Alert on and block Ethereum contract address 0x1280a841Fbc1F883365d3C83122260E0b2995B74 in any outbound HTTP body
Workarounds
- Do not download Minecraft mods from YouTube video links or unknown third-party sites — use only official Modrinth or CurseForge repositories
- Run Minecraft in a sandboxed environment (separate user account with no access to browser profile directories)
- Block javaw.exe from making outbound connections to *.ru, *.cy, *.to, *.st domains at host firewall
Longer-term hardening
- Deploy EDR with behavioral rules: alert on cmstp.exe spawned by javaw.exe, PowerShell with Add-MpPreference from Java parent, lib*.tmp DLL extraction by javaw.exe
- Block execution of JAR files downloaded from untrusted sources via application control policy
- Implement DNS filtering to block DNS-over-HTTPS providers used for evasion by non-browser processes
- Deploy Sigma/Splunk/KQL detections for WeedHack behavioral IOCs (see detections phase)
- Educate user communities about fake Minecraft mod distribution vectors (YouTube, SEO-poisoned sites)
- Monitor Minecraft modding communities and file hosting sites for WeedHack-distributed JARs
- Implement network egress monitoring for WebSocket connections to *.ru domains from Java processes
Weaknesses (CWE) in WeedHack MaaS Campaign
CWE-494, CWE-327, CWE-522, CWE-269
Timeline of WeedHack MaaS Campaign
- Threat actor 'Majanito' creates the Majanito standalone credential stealer — a precursor tool targeting Minecraft users that would later be rebranded and expanded into the WeedHack MaaS platform.
- WeedHack Malware-as-a-Service platform officially launched. The platform offers a Fabric mod JAR builder, operator dashboard (weedhack.to / weedhack.cy), Telegram community (850+ operators), and tiered pricing ($5/month or $24.99 lifetime for premium RAT tier).
- C2 domain whnewreceive.ru confirmed active as the primary Stage 1 credential collection endpoint, receiving HTTP POST data from LoaderClient-infected victims including Minecraft session tokens and Microsoft OAuth access tokens.
- Threat actor rotates C2 infrastructure; whnewreceive.ru replaced as primary C2. New active C2 URL propagated silently to all infected clients via Ethereum smart contract 0x1280a841Fbc1F883365d3C83122260E0b2995B74 using the RSA-signed EtherHiding mechanism — no malware binary update required.
- Campaign surpasses 100,000 unique host compromises. Daily infection rate climbs to 2,000–3,000 new victims per day. Over 3,820 unique malicious JAR variants identified across 240+ active distribution URLs.
- McAfee Labs publishes primary threat disclosure 'Game Over: WeedHack' identifying the full four-stage infection chain, EtherHiding blockchain C2 mechanism, RSA-2048 signature verification, MaaS platform details, and campaign scale (116,000+ infections). Help Net Security amplifies same day.
- Independent security researchers (pog5, 0xresetti, thereallo.dev) publish deep-dive technical analyses of LoaderClient internals: JNIC v3.7.0 native compilation, decS string encryption cipher constants (k1=187, k2=67), full Java class hierarchy, UAC bypass via CMSTP with .xdmf config, and Stage 3 RAT WebSocket protocol details.
- Campaign remains active with no infrastructure takedown. Current active C2 fucktermedfir.st serving Stage 2 and Stage 3 payloads. Blockchain-based C2 resolution continues to defeat sinkholing and domain seizure attempts. Daily infection rate unchanged at 2,000–3,000 new victims.
Sources cited for WeedHack MaaS Campaign
- Game Over: WeedHack — McAfee Labs (Primary Disclosure)
- Minecraft Malware Loader Uses RSA-Signed Blockchain C2 — CybersecurityNews
- Weedhack Stealer — Technical Analysis (0xresetti)
- GitHub — pog5/weedhack-analysis (Community IOC & technical repository)
- Hackers Use Malicious Minecraft Fabric Mods to Deploy LoaderClient — GBHackers
- From Minecraft Mods to Malware-as-a-Service: Inside the WeedHack Ecosystem — PolySwarm
- LoaderClient Malware Uses Ethereum Smart Contracts for C2 — CyberPress
- Weedhack Attacks Minecraft Users — The Hacker News
- Malware campaign targeting Minecraft users infects over 116,000 systems — Help Net Security
- WeedHack Minecraft Malware Spreads Through YouTube and SEO Poisoning — CyberPress
- That Minecraft Dupe Mod Is Not Just a Stealer — thereallo.dev (Technical RAT analysis)
Threats related to WeedHack MaaS Campaign
- WeedHack MaaS Infostealer — Trojanized Minecraft Mods/Clients via YouTube + SEO Poisoning, 36-Browser & Crypto-Wallet Credential Theft with Paid RAT Tier (CVE-N/A)
- NanoCore RAT VBScript Loader Using Chr()/Math/Flow-Control Obfuscation to Evade Static Detection (CyberChef Analysis)
- Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
- Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and Lumma Stealer to the Retro Gaming / PlayStation Vita Modding Community
- TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry
- Remcos RAT Delivered via Steganographic Multi-Stage Loader in 'GST Debit Note' India-Targeted Phishing Campaign
Detection coverage for TL-2026-0969
As of 2026-06-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0969 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.