WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient) — Threadlinqs Intelligence
As of 2026-06-28, WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient) is a critical-severity malware threat attributed to Majanito, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-0969 · Severity: CRITICAL · Status: ACTIVE · Category: MALWARE
Attribution: Majanito · FINANCIAL
WeedHack is an active Malware-as-a-Service platform distributing LoaderClient — a multi-stage Java RAT — via trojanized Minecraft Fabric mods promoted through YouTube social engineering and
WeedHack is a Malware-as-a-Service (MaaS) platform created by the threat actor known as 'Majanito' — an evolution of their earlier standalone credential stealer tool of the same name created in late 2025. The platform provides 850+ registered operators with a JAR builder that generates malicious Minecraft Fabric mod files targeting Minecraft Java Edition versions 1.21.0–1.21.11 on Windows. Operators distribute the generated mods via YouTube videos (recorded with voice-over narration; individual videos achieving 7,500+ views), SEO-poisoned websites impersonating legitimate Minecraft mod repositories (Modrinth, CurseForge lookalikes), and GitHub repositories.
The infection chain is four-staged. Stage 1 (LoaderClient) is a malicious Fabric mod JAR. When Minecraft launches with the mod installed, or when the JAR is executed standalone, it decrypts its embedded strings using a custom 'decS' cipher (two interleaved integer arrays XOR-mixed with a substitution box and position-dependent bit rotation, constants k1=187, k2=67). It then harvests the victim's Minecraft session data — display name, UUID, and live Microsoft OAuth access token — and HTTP POSTs these to the operator's credential collection endpoint. Critically, the malware contains no hardcoded C2 domain. Instead it calls `eth_call` against 32 hardcoded public Ethereum JSON-RPC endpoints (Llamarpc, Publicnode, Tenderly, Flashbots, DRPC, and others) with function selector 0xce6d41de (keccak256 of `getText()`) against contract address 0x1280a841Fbc1F883365d3C83122260E0b2995B74. The contract returns an ABI-encoded string in the format `<C2_URL>|<RSA_SIGNATURE>`. The malware verifies the signature using an embedded RSA-2048 public key (SHA256withRSA) before trusting the URL. This EtherHiding mechanism defeats sinkholing: the blockchain is immutable, the RSA signature prevents third-party URL injection even if the contract owner key is revoked, and 32 redundant RPC endpoints survive any single-endpoint block.
Stage 2 (WeedHack Module) is downloaded entirely in-memory via ExtraClassLoader (no disk write for the JAR). It is compiled with JNIC v3.7.0, converting Java bytecode to native Windows DLLs (x86_64 and aarch64) embedded as LZMA-compressed .dat resources. Stage 2 disables SSL certificate validation, switches to DNS-over-HTTPS for network evasion, calls PowerShell hidden to add `C:\Users` to Windows Defender exclusions, and executes a CMSTP UAC bypass (spawning cmstp.exe with a .xdmf INF config) to gain elevated privileges. It then establishes persistence via three mechanisms: HKCU Run key, a scheduled task named JavaSecurityUpdater (ONLOGON, HIGHEST privilege), and a watchdog task JMonitoringTask (every 2 minutes). The full credential-stealer payload targets 36 browsers (Chrome, Edge, Brave, Opera, OperaGX, Vivaldi, Yandex, and 29 others), 56 browser-based cryptocurrency wallet extensions (MetaMask, Phantom, Coinbase, Trust Wallet, Exodus Web3, Ronin, Keplr, Solflare, and 48 others), 12 desktop cryptocurrency wallets, Discord tokens, Steam credentials, and Telegram tdata. It also searches for files containing keywords 'password', 'seed', 'wallet', 'crypto', '2fa', 'backup'. Specific Minecraft launcher data is targeted: Lunar Client accounts.json, Essential Mod microsoft_accounts.json, Feather Launcher account.txt (DPAPI+AES-GCM), Modrinth App app.db (SQLite), and numerous client mods (Meteor, Radium, Wurst, Aristois, LiquidBounce, Impact, Future, Inertia, Cornos, WWE, 3arthh4ck, Salhack, Phobos, Gamesense).
Stage 3 (Component RAT) is downloaded from `<C2>/files/jar/component`, versioned via `/api/component/lastModified`, and provides the premium-tier RAT: real-time keylogging via Socket.IO, webcam capture at 25 FPS, screen sharing at 720p (WebP @ 0.85 quality), remote shell via ProcessBuilder, file manager with upload/download, and keyboard/mouse injection via java.awt.Robot. All RAT communications use WebSocket (wss://) to remotev2.wh*.ru endpoints. Stage 4 is a developer
Weaknesses (CWE)
CWE-494, CWE-327, CWE-522, CWE-269
Target sectors: gaming, consumer, finance, cryptocurrency, education
Target regions: North America, Europe, Asia, Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1593, T1588, T1583, T1608, T1608, T1566, T1195, T1204, T1059, T1059