Attackers are tricking Minecraft players into downloading malware by cloning legitimate mod/client websites and manipulating search results so the malicious pages appear highly ranked. Even after the malware’s command-and-control systems were disrupted, the fake sites and trusted file-hosting links (Discord, MediaFire, GitHub, Dropbox) continued to distribute malicious Java (JAR) downloads that steal credentials and other sensitive data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You Google “Xenon Client download,” click the top result, and boom, WeedHack just rode in with your Minecraft mod. The site looks perfect, branding, FAQs, even real GitHub links, but that big Download button is a malicious JAR. WeedHack steals Minecraft session IDs, browser passwords, cookies, even crypto wallet data. McAfee still saw over 6,300 hits to these fake WeedHack sites in a month, mostly through Discord and MediaFire links. The trick: they abuse trusted platforms, so the Discord or Dropbox logo makes the file feel safe. Here’s the move: before you run any Minecraft mod or client JAR, ignore the search rank and the platform logo, go to the project’s official site or release page yourself and only download from there.
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
Attackers are tricking Minecraft players into downloading malware by impersonating popular Minecraft clients and resellers in Google search results. Even after the campaign’s command-and-control infrastructure was taken down, the operation continued by shifting distribution to common file-hosting…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
The bulletin describes an APT36 (Transparent Tribe) espionage campaign that uses social-engineering lures and spoofed download portals to trick targets into installing a malicious Windows installer. The installer (“TMS_AfghanTelecom.exe”) deploys the PATCHCORD backdoor, which then calls out to…
Researchers found 16 look‑alike (typosquatted) RubyGems packages that trick developers into installing a Windows information stealer. The malicious gems run code automatically during installation, pull down additional malware, and then steal browser logins and crypto wallet data before uploading it…
Researchers uncovered a long-running “SEO poisoning” operation that manipulates Bing search results to push people onto fake support and activation pages. Victims are steered through a chain of redirects to either download a malware-laced ZIP (MayaBot) or be pressured into calling a fake…
