Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to push malicious downloads that steal passwords, cookies, and crypto wallets.
The WeedHack campaign targets Minecraft players by impersonating popular clients and mods. Attackers build polished fake websites that copy the real tool's features, FAQs, installation steps, developer information, and even links to legitimate GitHub repositories. This mix of real and fake content makes the sites look detailed and convincing, so most users have little reason to suspect anything.
Distribution relies on two main channels. First, SEO poisoning pushes fake sites to the top of Google search results, as seen when the first two results for a popular client called Xenon Client both led to WeedHack-distributing pages. Second, Discord communities are used to promote fake downloads, including one channel promoting a fake client that had more than 1,900 members. File hosting services like MediaFire and Dropbox are also used to host the actual malicious files.
Even after the WeedHack command-and-control infrastructure was disrupted, researchers still found active malicious sites and file-hosting accounts continuing to spread the malware. Several factors explain why the campaign persists:
The most reliable defense is sourcing software only from official developer repositories or trusted platforms such as Modrinth and CurseForge, rather than trusting search results or Discord links. Treat any request to disable antivirus protection as a strong signal of malware. Security awareness efforts for gaming-adjacent audiences, including general staff, students, interns, and IT support teams who field related questions, should reinforce that a professional-looking site or an active-looking community is not proof of legitimacy.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
WeedHack is an infostealer distributed through fake Minecraft client and mod websites that steals cookies, passwords, browser data, and crypto wallets from infected devices.
Attackers use SEO poisoning so fake sites rank at the top of Google searches for popular Minecraft clients, and they also promote malicious download links inside Discord communities.
The fake sites copy the real tool's features, FAQs, installation steps, and developer information, and some even link to legitimate GitHub repositories to appear authentic.
Only download mods and clients from official developer repositories or trusted platforms such as Modrinth and CurseForge, and be suspicious of any tool that suddenly has a new official website.
You Google “Xenon Client” for Minecraft, click the top result… and quietly install WeedHack malware instead. Researchers found those top Xenon Client results were fake sites pushing WeedHack. They copy the real features, FAQs, even link to the legit GitHub, but the download is an infostealer that nabs cookies, passwords, and crypto wallets. And it’s not just Google. McAfee saw almost half of malicious links coming from Discord, servers hyping a 'DonutSMP client' or packs of mods, all routed through MediaFire or Dropbox, all dropping the same WeedHack payload. Here’s the move: if a Minecraft client or mod isn’t coming from the project’s real GitHub, Modrinth, or CurseForge, and especially if the installer asks you to disable antivirus, back out and report the link to security.
Researchers showed that a single public GitHub issue (from someone with no repo access) could steer popular AI coding agents into running dangerous commands, exposing tokens, and changing repositories. The risk comes from AI agents reading untrusted issue/PR text while also having access to…
After Black Hat/DEF CON, cybercriminals allegedly targeted conference attendees by impersonating a CoinDesk executive over X direct messages. Victims were pushed into a realistic workflow using Google Docs and a fake Dropbox DocSend installer to trick them into running malware on macOS or Windows.
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
A researcher was targeted after Black Hat/Def Con by an attacker posing as a CoinDesk executive and using X direct messages to build trust. The scam used familiar platforms (Google Docs and Dropbox DocSend) to push “ClickFix”-style steps or a fake installer intended to get the victim to run malware.
Researchers described two active social-engineering-driven malware campaigns: one uses trojanized “popular” remote-user apps (e.g., Zoom/WebEx lookalikes) to trick people into installing credential and crypto-stealing malware, and another uses hundreds of imposter GitHub repositories to lure…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
