Hackers Use YouTube and SEO Poisoning to Spread WeedHack Minecraft Malware

Hackers are hiding dangerous malware inside what look like popular Minecraft mods and game clients, using YouTube videos and search engine tricks to pull unsuspecting players into their trap.

The campaign, known as WeedHack, has been quietly running since January 2026 and has already racked up over 116,000 victims worldwide.

What makes this campaign particularly alarming is how it packages itself as a legitimate service. WeedHack operates as a Malware-as-a-Service (MaaS) platform, meaning anyone can sign up, download a ready-made malicious payload, and start infecting others.

The free tier alone is capable of stealing passwords from 36 browsers, grabbing credentials from over 56 browser-based crypto wallets, and swiping Discord, Steam, and Telegram login details.

Analysts at McAfee Labs, who authored a report shared with Cyber Security News (CSN), uncovered the full scope of this campaign.

They found over 3,820 unique malicious JAR files and more than 240 URLs actively distributing the malware at a rate of roughly 2,000 to 3,000 new infections per day. The campaign is most active in the United States, Germany, India, and the United Kingdom.

Perhaps the most unsettling finding is who is actually using this malware. Researchers discovered that many WeedHack customers appear to be teenagers and young adults who are using the tool not just to steal accounts, but to harass and bully their victims.

They have been recording people through hijacked webcams and sharing those videos in Telegram channels as a form of cybercrime bragging.

If someone falls victim to this malware and is threatened by an attacker claiming to have hacked their system, researchers strongly recommend not following the attacker’s instructions.

Instead, victims should reach out to a trusted adult such as a parent or guardian and report the incident immediately, as complying with the attacker could lead to further harm.

Hackers Use YouTube and SEO Poisoning

WeedHack spreads in two primary ways: fake YouTube videos and SEO poisoning. Threat actors upload polished, well-edited videos showcasing Minecraft mods and clients, often including voiceovers to sound more authentic.

One such video had accumulated over 7,500 views and included a link to the malicious download site in its description.

The campaign actively targets Minecraft mods that do not have official websites, making it easier to dominate search results for those keywords.

These fake sites are built to look convincing, and some even include fake security warnings telling users to only download from their page and link to official Discord servers and GitHub pages to appear trustworthy.

Beyond videos, the campaign instructs its customers to participate in Discord and Reddit discussions to quietly promote their malicious sites without drawing suspicion.

The WeedHack dashboard even provides step-by-step tutorials on how to use both methods effectively, including tips on keyword targeting and avoiding common mistakes.

EtherHiding and Multi-Stage Payload Delivery

What sets WeedHack apart technically is its use of EtherHiding, a technique that hides the malware’s command-and-control server address on the Ethereum blockchain.

This makes it extremely difficult to take down the infrastructure because the C2 address is not stored in the malware itself but fetched live from a blockchain smart contract. Responses are also RSA-signed to prevent anyone from hijacking the campaign.

Once a victim runs the infected JAR file, the malware launches a four-stage infection chain. The first stage quietly fetches the C2 domain from the blockchain.

The second stage then loads an obfuscated payload directly into memory using a custom class loader. Stages three and four establish persistence on the system and deploy the remote access tools, including webcam access, keylogging, and reverse shell capabilities.

The malware also drops a script that adds dozens of exclusion paths to Windows Defender, effectively blinding the built-in antivirus. A watchdog task then runs every two minutes to restore any deleted components, making manual removal very difficult without specialized tools.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.