Weedhack malware traps Minecraft gamers via fake websites and SEO poisoning
Downloading mods or utility applications for Minecraft carries significant security risks, as cybersecurity analysts have recently discovered a large-scale malware distribution campaign targeting the gaming community directly.
Using AI to build fake websites and manipulate search results
According to data from McAfee Labs, experts blocked over 6,300 user visits to malicious websites hosting the Weedhack malware. Threat actors designed a series of websites impersonating popular Minecraft software and utilities (such as Glazed Client, Radium Client, Xenon Client, or SeedCrackerX). These websites meticulously copied everything from the interface, logo, and feature list to installation guides and GitHub links of the original projects.
Notably, the attackers used the artificial intelligence (AI) website builder tool Lovable to shorten development time and easily create highly convincing fraudulent sites.
By leveraging Search Engine Optimization (SEO) poisoning techniques, these fake addresses even outranked official websites on search result pages of Google, Microsoft Bing, Brave Search, and DuckDuckGo. When searching for software, users could easily misclick on malicious links located right at the top of the list.
Diverse distribution channels and Weedhack malware's mechanism of harm
In addition to using fake websites, the attackers also distributed malicious links across multiple online platforms. Statistics from McAfee Labs indicate that Discord was the primary sharing channel with 49.6% of malicious links, followed by MediaFire (23.4%) and GitHub (8.2%). Several malware-laden files were also uploaded to familiar Minecraft mod-sharing forums like Planet Minecart or EndMods.
First recorded in June 2026, Weedhack operates in multiple stages. When a victim opens an executable file in JAR format, the malware performs the following:
Collects detailed information about the victim's device.
Automatically sets up exclusion lists in the Microsoft Defender security tool to evade detection.
Extracts and steals sensitive data stored on the computer.
The tactic of using malicious SEO techniques to push fraudulent pages to the top of search results is becoming a concerning trend. Previously, in June 2026, security firm Check Point also detected a campaign impersonating open-source projects to distribute malware families such as Remus Stealer, AnimateClipper, or SessionGate.
Security recommendations for users
To avoid falling victim to Weedhack and similar malware, cybersecurity experts recommend:
Download software, utility tools, and mods only from official sources or reputable repositories.
Keep operating systems and security applications updated to the latest versions.
Run virus scans on newly downloaded files before executing them.
Exercise high vigilance and decline software that requests turning off security features or antivirus software prior to installation.
The explosion of website builder tools combined with search manipulation techniques demonstrates that information security risks can arise from the simplest search actions. Users need to proactively verify URL addresses and file origins carefully to protect personal data against cyber threats.
Refer to: The Hacker News
