Back Technadu

WeedHack Malware Infects 116,000+ Minecraft Systems via Fake Mods

Technadu • June 3, 2026

A large-scale malware campaign dubbed WeedHack is actively targeting Minecraft players and has infected more than 116,000 systems since January. According to McAfee telemetry, 116,464 systems have been compromised, with between 2,000 and 3,000 new infections occurring every day.

Most victims are located in the U.S., Germany, India, and the U.K.

The malware spreads through Minecraft-related malicious mods, clients, cheats, and utilities on YouTube and via SEO poisoning, with more than 240 distribution URLs and 3,820 unique malicious JAR files identified.

The campaign targets keywords associated with popular Minecraft clients, including:

McAfee noted that many of these projects lack official websites and exist only as GitHub pages, making them easier for attackers to impersonate.

WeedHack operates as a malware-as-a-service (MaaS) infostealer , providing customers with a dashboard to view stolen credentials and data from compromised systems. The platform is hosted on the clearnet and freely accessible.

The free tier targets Minecraft session IDs, cookies, and saved passwords across 36 browsers, 56 cryptocurrency add-ons, 12 desktop cryptocurrency wallet apps, and Discord, Steam, and Telegram credentials. It can also capture screenshots.

The premium tier, priced at $5 per month or a one-time lifetime payment of $24.99, adds remote control with mouse and keyboard input, webcam access, a keylogger, remote shell, and remote file management. WeedHack's Telegram channel has over 800 members.

Minecraft players should only trust mods from official project sources and verify all download links before proceeding. JAR files hosted on dubious sites should be treated with caution. For the safest way to extend the gaming experience, the Minecraft Marketplace remains the recommended option.

Last month, Ukraine investigated a teen suspected of using Infostealers to breach 30,000 customer Accounts at a California online retailer. In April, Rockstar Games announced a data breach that did not impact the organization or its players.

In early 2025, a Path of Exile 2 data breach resulted in hacked player accounts and the theft of in-game items.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WeedHack Malware Campaign Infects Over 116,000 Minecraft Players The WeedHack malware campaign has reportedly infected over 116,000 Minecraft players since January 2026. This malware is distributed through fake mods, cheats, and utilities primarily via YouTube and SEO poisoning. The operation, described as malware-as-a-service (MaaS), allows users to access a dashboard displaying stolen credentials and data from compromised systems. Most victims are located in the United States, Germany, India, and the UK. The malware targets sensitive information, including Minecraft session IDs, browser cookies, and saved passwords. It has evolved to include remote access capabilities, allowing attackers to control infected systems. The campaign is particularly concerning due to its low cost of entry for potential attackers, attracting many young individuals. McAfee researchers have identified over 240 distribution URLs and 3,820 unique malicious JAR files associated with the campaign. 20 sources 70

Extracted Entities

WeedHack Malware Infects 116,000+ Minecraft Systems via Fake Mods

The full story

Extracted Entities

Attack Types (2)

Companies (2)

Countries (3)

Malware (1)

MITRE ATT&CK (2)

Platforms (5)