Weedhack, a Malware-as-a-Service (MaaS) operation specifically engineered to prey on Minecraft players, that has been active since at least January 2026.
The service packages credential theft, cryptocurrency wallet extraction, account hijacking and full remote-access capabilities into a low-cost, subscription-based offering marketed through SEO poisoning,YouTube promotion and counterfeit Minecraft mod websites.
By combining polished distribution tactics with decentralized infrastructure retrieval and a customer-facing dashboard, Weedhack substantially lowers technical barriers for novice threat actors and raises the threat level across gaming communities, especially for younger users.
Technical analysis shows Weedhack primarily distributes trojanized Java Archive (JAR) files masquerading as popular Minecraft clients and mods.
Upon execution the malware relaunches under javaw.exe to hide consoles, reads embedded configuration data, and decrypts Ethereum JSON-RPC endpoints, smart contract identifiers and an embedded RSA public key.
This enables the binary to query Ethereum smart contracts for live command-and-control (C2) endpoints and validate responses cryptographically, a resilience mechanism that complicates takedown efforts.
Polyswarm said in a report shared with GBhackers, reported 32 distinct JSON-RPC endpoints and identified more than 3,820 malicious JAR samples and over 240 distribution URLs linked to the ecosystem.
Weedhack’s multi-stage architecture uses JNIC obfuscation to translate Java bytecode into native code, increasing reverse‑engineering difficulty. Initial reconnaissance collects system metadata, enumerates installed software, and attempts to create Windows Defender exclusions.
Subsequent payloads harvest browser credentials and cookies, Discord tokens, Steam and Telegram credentials, and Minecraft session identifiers and launcher data enabling account hijacking without full password disclosure.
The free tier already supports credential and browser data theft, screenshot capture, Discord token theft, and wallet targeting; premium subscriptions add robust remote-access functionality including keylogging, screen sharing, file management, reverse shells and webcam monitoring access.
Significant technical details distinguish Weedhack from typical gaming threats. The campaign targets a broad list of popular clients and mods Meteor Client, Aristois, LiquidBounce, Impact Client and others and operators build professional-looking sites to dominate niche search results.
The service’s dashboard reportedly shows more than 116,000 accumulated hits and includes malware builders, tutorials, OPSEC guidance and leaderboards that gamify infections.
Researchers observed over ten current domains and multiple historical domains tied to the same actor cluster, plus evidence that many customers are teenagers or young adults using the tool for account theft, harassment and surveillance.
Operational behaviors raise acute privacy and safety concerns. Analysts documented instances of remote-access misuse for harassment and cyberbullying, including sharing webcam images and recorded material in criminal communities.
The presence of low-cost subscription tiers (starting at roughly $5 USD per month) and extensive distribution instructions means inexperienced actors can quickly mount effective campaigns against peers, exacerbating risk within youth-centered gaming communities.
Defenders should treat seemingly benign Java-based gaming software as potential attack vectors. Effective detection requires dynamic analysis, behavioral monitoring and infrastructure correlation because Weedhack’s staged delivery, blockchain-driven C2 discovery and strong obfuscation defeat many signature-based controls.
Practical mitigations include scanning mod files in sandboxes before execution, enforcing least-privilege Java runtime policies, blocking known malicious domains and JSON-RPC endpoints, and educating players on obtaining mods from verified sources.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…