Back Securityaffairs.Co

Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown

Securityaffairs.Co •Pierluigi Paganini • August 25, 2026

WeedHack Minecraft Malware Survives C2 Takedown: Fake Client Sites Still Active, SEO Poisoning Puts Malicious Downloads at the Top of Google McAfee Labs published a follow-up report on the WeedHack Malware-as-a-Service campaign this week, documenting ten active malicious sites and multiple file-hosting accounts that are still spreading the infostealer despite a disruption to its command-and-control […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WeedHack Malware Campaign Targets Minecraft Players via Fake Clients The WeedHack malware campaign continues to target Minecraft players, infecting over 116,464 users despite the takedown of its command-and-control infrastructure in July 2026. McAfee Labs reported blocking over 6,300 attempts to access malicious sites linked to WeedHack in the past month. Attackers are now utilizing file-hosting services like Discord and MediaFire to distribute the malware, which spreads through SEO poisoning and fake Minecraft client sites. Researchers identified multiple active malicious sites and noted that SEO tactics have placed these sites at the top of Google search results. Gamers are advised to download files only from trusted sources and to be cautious of offers for free or cracked software. The ongoing nature of this campaign suggests a significant threat to the gaming community. 10 sources 70

Extracted Entities

Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)