Hackers Spread WeedHack Malware via YouTube and SEO Poisoning

Hackers are increasingly abusing trusted platforms like YouTube and search engines to distribute malware, and a newly uncovered campaign targeting Minecraft players highlights how effective this tactic has become.

Minecraft, originally released in 2011 by Mojang Studios, remains the best-selling video game globally with more than 350 million copies sold.

Its open ecosystem, which supports mods, custom clients, and third-party launchers, has made it a prime target for cybercriminals. Threat actors routinely disguise malware as popular mods or cheats, exploiting users seeking gameplay enhancements.

The WeedHack campaign, active since January 2026, takes this abuse to a new level by combining large-scale distribution with a user-friendly criminal service model.

Researchers discovered more than 3,820 malicious JAR files and over 240 distribution URLs linked to the campaign. These files impersonate legitimate Minecraft mods and clients, tricking users into executing malware.

Some videos have already attracted thousands of views, generating consistent traffic to malicious websites. In parallel, attackers manipulate search engine rankings using SEO poisoning techniques, targeting niche or less regulated Minecraft mods to dominate search results.

A key distribution method involves YouTube videos that appear to showcase mod tutorials or client reviews. These videos include download links in descriptions and comments, often reinforced by fake user feedback claiming the files are safe.

McAfee Labs said in a report shared with GBhackers, identified a large-scale Malware-as-a-Service operation called “WeedHack” that leverages SEO poisoning and video content to infect unsuspecting users with credential stealers and remote access tools.

Once executed, the malware initiates a multi-stage infection chain. The first-stage payload relaunches itself using “javaw.exe” to remain hidden and extracts configuration data embedded within the file.

It then leverages a technique known as EtherHiding, querying Ethereum blockchain smart contracts via JSON-RPC endpoints to dynamically retrieve command-and-control infrastructure.

The use of RSA-signed responses ensures the integrity of these communications and prevents takeover by other threat actors.

Subsequent stages deploy heavily obfuscated payloads using Java Native Interface techniques, making analysis significantly more difficult.

The malware establishes persistence through registry modifications and scheduled tasks, disables Windows Defender protections by adding multiple exclusions, and performs extensive system reconnaissance.

Hackers Spread WeedHack Malware

It collects system details, captures screenshots, and steals sensitive data including browser credentials, Discord tokens, and cryptocurrency wallet information.

In its final stage, WeedHack deploys a full-featured remote access trojan. It enables attackers to monitor victims in real time, access webcams, log keystrokes, execute commands, and transfer files.

Communication with command servers is maintained through WebSocket connections, and firewall rules are modified to allow uninterrupted access.

What makes this campaign particularly concerning is its accessibility. Unlike traditional MaaS operations that cost hundreds of dollars and operate on dark web forums, WeedHack offers a free tier and a premium subscription starting at just $5 per month.

The platform includes a web-based dashboard where users can view stolen data, build custom payloads, and access tutorials on malware distribution techniques.

Researchers also found that the campaign is widely used by teenagers and young adults, many of whom lack technical expertise but exploit the platform for harassment and cyberbullying.

Victims have reportedly been monitored through webcams and threatened, with recordings shared as trophies in private channels.

The campaign has already generated over 116,000 infections, with the highest impact observed in the United States, Germany, India, and the United Kingdom.

Its combination of low cost, ease of use, and aggressive distribution through mainstream platforms significantly lowers the barrier to entry for cybercrime.

This development underscores a growing trend where threat actors weaponize legitimate platforms and simplify advanced attack techniques for массов adoption.

For Minecraft players and the broader gaming community, it serves as a reminder that unofficial mods and downloads remain a high-risk vector for malware infections.

Indicator of Compromise

F2100e1f73477bc565f8909e06 9942dac1f884654ed4ba213ca 9a84b1e761ab8	Glazed_Addon-1.0.0.jar
D3f2464ae0e48218e1d48bdfab 8301ee5236f7624adcdba1720 dc27058461076	paper-rig-mod-new.jar
B982fbafa954a8dcf7cfcffe31bc F75a86b052b1f01cf535ffcafd2c 48a56b60	RadiumClient.jar
29546a03e07bfeb3025313b12 671c758ced1c4921a4bc859a7 ab40ec52584cdb	Radium-1.0.0 (1).jar
D81b98a69363d8d994ef553be Eb5e15384ed32f0e343708b73 c7e6b313b9aace	Bedrockfinder-1.0.0.jar
F790346bece8e448313f701586 Cc7fd18291dfda721aae8d86eb facf14055645	4e client 1.21.11.jar
5f7680feccc15814299df3c3c1 1e9b1c4f33069aac5a19c03b8 7e15f30c2312b	AutoRynek-1.21.4.jar
256b5b5d0524c442261028767 B94f7188b0b81663b50c63300 fca7733a04ea7d	donutsmp-duper-1.0.0.jar
E123d1f7cbea562237f7a5f506 38d148fb58048c9ad095e0b0a d52e43bfedad0	GodMode-2.8.1.jar
D468983f98ff100ad8fd613315 Af4c88d67bec76782b66b260c 413c587987bf0	krypton-cracked-1.0.0.jar
Ef31bb219b84744e02f90947f3 1a25958b2b34524ed3795799e d6eff876e4bcd	krypton-cracked-1.0.01.jar
5d537a058ec19e6ceea593738 F122b777d866042ea0bad1945 39757de13c46f4	Example-1.0.0.jar
697ee941abee202d8e84e5e3f Ed8b9f34eea8772ee56dc867fc e017507a5eeaf	Krypton-1.0.0.jar
F9a6911e8d9130c779db2e79f9 01d75d90f9e3ad08c36e7fb927 959b7d988bae	Vapev4-1.21.11.jar
86f8c0a92eb9aba3c34166673 61652a9e11b6ddc1119bb5b35 64bc107b950ddb	Example-1.0.0.jar
790ff5cda1668e7aa390fbb168 2a4d578195aa40542f64b7b6d 56a6eccde12c9	Donutdupeworking-1.21.11.jar
Db533717da686f3b76b9de85e Cd80d326a14572056a33d31f7 94bffbffd96c26	opticam-1.0.0.jar
8b53f53f72b8fef755666b6f239 C06a69a9940e1b9f5d19e0221 50750035fa80	Nightsoulv2-1.21.11.jar
6b2218999ac27f6085cb02f693 A3c99bd6abedfc20e00e22709 e526015c89f4e	asdasd-1.21.111.jar
9682adf40a3621ffe5e1b426c5 B90d0ed70e663738857bb4d18 d37d93bbd4e6c	dupe_bypass_1.21.11-1.21.11.jar

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.