Hackers are weaponizing malicious Minecraft Fabric mods to deliver LoaderClient. This stage-one malware loader steals session data and hands it off to the WeedHack stealer through a fileless, blockchain-backed execution chain.
The campaign stands out for its use of EtherHiding, where the command-and-control URL is pulled from an Ethereum smart contract instead of a conventional server, making takedown efforts far less effective.
LoaderClient is disguised as a Fabric mod JAR and activates when Minecraft launches, letting it harvest the player’s display name, account UUID, and live Microsoft OAuth access token from the session object.
It then resolves its C2 through an Ethereum contract, verifies the response with RSA, downloads the next-stage payload, and executes it entirely in memory without writing the second stage to disk.
DarkAtlas said in a report shared with GBhackers, LoaderClient is a Minecraft-based malware loader linked to the WeedHack Malware-as-a-Service campaign.By June 2026, the campaign had logged over 116K unique host compromises, averaging 2,000 to 3,000 new infections every 24 hours.
WeedHack originated in late 2025 as a private, targeted credential stealer called Majanito, developed by a threat actor using the same handle.
The malware is linked to the WeedHack malware-as-a-service operation, which has logged more than 116,000 unique host compromises since January 2026, according to the attached analysis.
The Ethereum contract has since been updated to resolve to fucktermedfir[.]st, demonstrating the operator’s ability to rotate infrastructure without recompiling or redistributing payloads.
The campaign uses both a free tier and a low-cost premium tier, lowering the barrier for inexperienced operators and turning game-mod distribution into a high-volume infection channel.
The report also notes that the same Ethereum contract address is reused across stages, which creates a durable indicator for tracking the operation.
LoaderClient uses multiple evasion layers at once: custom string obfuscation, a zip-bomb-style anti-analysis payload, console suppression via javaw.exe, and in-memory stage-2 loading through a custom class loader.
The second stage is compiled with JNIC, hides logic inside native DLLs, turns off SSL validation, and uses DNS-over-HTTPS to bypass network monitoring. In practical terms, this means the malware is built to resist static analysis, frustrate sandboxing, and evade common defensive controls.
The most important detection point is not the dropped JAR itself but the abnormal Ethereum RPC traffic generated by non-blockchain software.
The contract returns an ABI-encoded string. The malware decodes it, splits on the last | character, and verifies the URL portion against the hardcoded RSA public key using SHA256withRSA.
Security teams should also treat unsigned Minecraft mods launches, mod-pack downloads from unofficial sources, and mod installers that request account-like permissions as high-risk artifacts.
Because the access token theft can enable account takeover, defenders should assume credential exposure even if no password was captured.
Other relevant details tied to this incident include the campaign’s use of YouTube-based lure videos, SEO-poisoned download pages, and lookalike mod branding to push victims toward malicious JARs.
The analysis also ties the operation to a broader gaming-community abuse pattern, where attackers exploit trust in third-party mod ecosystems to spread credential stealers and RATs.
| Type | Value |
|---|---|
| SHA256 | F91714F89616002C6C1411233470F58E74FAD7CB5A7DA6F77AA6082F5D2E8771 |
| SHA1 | F7911F5BE3D08DA95DCDA8AFB1BEB8E462376F9D |
| MD5 | D991A7C9E2C3B269975404405A79ADBC |
| JAR entry | META-INF/README.txt |
| JAR entry | cfg.json |
| Stage-2 | |
| SHA256 | E7D1346153B49CE403687BBD0DDBF1DB63DE6808D64EA2812EA48EF0CFE7CF2A |
| Resource | dev/jnic/lib/dac261f0-fd12-4fb9-9a32-6a945ac10c4c.dat |
| Extension | .acdm |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…