# WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient)

> WeedHack is an active Malware-as-a-Service platform distributing LoaderClient — a multi-stage Java RAT — via trojanized Minecraft Fabric mods promoted through YouTube social engineering and SEO-poisoned portals. The campaign features a novel blockchain-based C2 mechanism (EtherHiding) where the current C2 URL is retrieved from Ethereum smart contract 0x1280a841Fbc1F883365d3C83122260E0b2995B74 and authenticated via an embedded RSA-2048 public key, making infrastructure takedown ineffective. As of June 2026 the campaign has compromised 116,000+ systems at a rate of 2,000–3,000 new infections daily, harvesting Microsoft OAuth tokens, browser credentials, cryptocurrency wallets, and deploying a full-featured RAT.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-06-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0969
- **ID:** TL-2026-0969
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Majanito
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

WeedHack is a Malware-as-a-Service (MaaS) platform created by the threat actor known as 'Majanito' — an evolution of their earlier standalone credential stealer tool of the same name created in late 2025. The platform provides 850+ registered operators with a JAR builder that generates malicious Minecraft Fabric mod files targeting Minecraft Java Edition versions 1.21.0–1.21.11 on Windows. Operators distribute the generated mods via YouTube videos (recorded with voice-over narration; individual videos achieving 7,500+ views), SEO-poisoned websites impersonating legitimate Minecraft mod repositories (Modrinth, CurseForge lookalikes), and GitHub repositories.

The infection chain is four-staged. Stage 1 (LoaderClient) is a malicious Fabric mod JAR. When Minecraft launches with the mod installed, or when the JAR is executed standalone, it decrypts its embedded strings using a custom 'decS' cipher (two interleaved integer arrays XOR-mixed with a substitution box and position-dependent bit rotation, constants k1=187, k2=67). It then harvests the victim's Minecraft session data — display name, UUID, and live Microsoft OAuth access token — and HTTP POSTs these to the operator's credential collection endpoint. Critically, the malware contains no hardcoded C2 domain. Instead it calls `eth_call` against 32 hardcoded public Ethereum JSON-RPC endpoints (Llamarpc, Publicnode, Tenderly, Flashbots, DRPC, and others) with function selector 0xce6d41de (keccak256 of `getText()`) against contract address 0x1280a841Fbc1F883365d3C83122260E0b2995B74. The contract returns an ABI-encoded string in the format `<C2_URL>|<RSA_SIGNATURE>`. The malware verifies the signature using an embedded RSA-2048 public key (SHA256withRSA) before trusting the URL. This EtherHiding mechanism defeats sinkholing: the blockchain is immutable, the RSA signature prevents third-party URL injection even if the contract owner key is revoked, and 32 redundant RPC endpoints survive any single-endpoint block.

Stage 2 (WeedHack Module) is downloaded entirely in-memory via ExtraClassLoader (no disk write for the JAR). It is compiled with JNIC v3.7.0, converting Java bytecode to native Windows DLLs (x86_64 and aarch64) embedded as LZMA-compressed .dat resources. Stage 2 disables SSL certificate validation, switches to DNS-over-HTTPS for network evasion, calls PowerShell hidden to add `C:\Users` to Windows Defender exclusions, and executes a CMSTP UAC bypass (spawning cmstp.exe with a .xdmf INF config) to gain elevated privileges. It then establishes persistence via three mechanisms: HKCU Run key, a scheduled task named JavaSecurityUpdater (ONLOGON, HIGHEST privilege), and a watchdog task JMonitoringTask (every 2 minutes). The full credential-stealer payload targets 36 browsers (Chrome, Edge, Brave, Opera, OperaGX, Vivaldi, Yandex, and 29 others), 56 browser-based cryptocurrency wallet extensions (MetaMask, Phantom, Coinbase, Trust Wallet, Exodus Web3, Ronin, Keplr, Solflare, and 48 others), 12 desktop cryptocurrency wallets, Discord tokens, Steam credentials, and Telegram tdata. It also searches for files containing keywords 'password', 'seed', 'wallet', 'crypto', '2fa', 'backup'. Specific Minecraft launcher data is targeted: Lunar Client accounts.json, Essential Mod microsoft_accounts.json, Feather Launcher account.txt (DPAPI+AES-GCM), Modrinth App app.db (SQLite), and numerous client mods (Meteor, Radium, Wurst, Aristois, LiquidBounce, Impact, Future, Inertia, Cornos, WWE, 3arthh4ck, Salhack, Phobos, Gamesense).

Stage 3 (Component RAT) is downloaded from `<C2>/files/jar/component`, versioned via `/api/component/lastModified`, and provides the premium-tier RAT: real-time keylogging via Socket.IO, webcam capture at 25 FPS, screen sharing at 720p (WebP @ 0.85 quality), remote shell via ProcessBuilder, file manager with upload/download, and keyboard/mouse injection via java.awt.Robot. All RAT communications use WebSocket (wss://) to remotev2.wh*.ru endpoints. Stage 4 is a developer-installed backdoor (Pjibf.exe — PureLogs/PureHVNC, obfuscated with NETReactor) that communicates with 45.141.119.34:50169 via RDP protocol and WebSocket to remotev2.whreceive.ru.

The MaaS platform offers a free tier (credential theft) and a premium tier ($5/month or $24.99 lifetime) for full RAT functionality. The operator dashboard (weedhack.to / weedhack.cy) provides a real-time leaderboard with 10-minute refresh, victim profiles with screenshots, IP addresses, and credentials, plus distribution tutorials, OPSEC guidance, and feature voting. McAfee Labs discovered the campaign and published a disclosure on June 3, 2026. As of late June 2026: 116,000+ unique compromised hosts, 2,000–3,000 new infections daily, 3,820+ unique malicious JAR files, 240+ active distribution URLs.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1218 System Binary Proxy Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1056 Input Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
- T1090 Proxy
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Game Over: WeedHack — McAfee Labs (Primary Disclosure)](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-as-a-service-campaign-research/)
- [Minecraft Malware Loader Uses RSA-Signed Blockchain C2 — CybersecurityNews](https://cybersecuritynews.com/minecraft-malware-loader-uses-rsa-signed/)
- [Weedhack Stealer — Technical Analysis (0xresetti)](https://0xresetti.github.io/weedhack.html)
- [GitHub — pog5/weedhack-analysis (Community IOC & technical repository)](https://github.com/pog5/weedhack-analysis)
- [Hackers Use Malicious Minecraft Fabric Mods to Deploy LoaderClient — GBHackers](https://gbhackers.com/loaderclient-and-weedhack-stealer/)
- [From Minecraft Mods to Malware-as-a-Service: Inside the WeedHack Ecosystem — PolySwarm](https://blog.polyswarm.io/from-minecraft-mods-to-malware-as-a-service-inside-the-weedhack-ecosystem)
- [LoaderClient Malware Uses Ethereum Smart Contracts for C2 — CyberPress](https://cyberpress.org/ethereum-sustains-weedhack-c2/)
- [Weedhack Attacks Minecraft Users — The Hacker News](https://thehackernews.com/2026/06/weedhack-attacks-minecraft-users.html)
- [Malware campaign targeting Minecraft users infects over 116,000 systems — Help Net Security](https://www.helpnetsecurity.com/2026/06/03/weedhack-minecraft-malware-campaign/)
- [WeedHack Minecraft Malware Spreads Through YouTube and SEO Poisoning — CyberPress](https://cyberpress.org/youtube-seo-spreads-weedhack/)
- [That Minecraft Dupe Mod Is Not Just a Stealer — thereallo.dev (Technical RAT analysis)](https://thereallo.dev/blog/this-minecraft-dupe-mod-is-a-rat)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0969