Attackers are tricking Minecraft players into downloading malware by cloning legitimate mod/client websites and manipulating search results so the malicious pages appear highly ranked. Even after the malware’s command-and-control systems were disrupted, the fake sites and trusted file-hosting links (Discord, MediaFire, GitHub, Dropbox) continued to distribute malicious Java (JAR) downloads that steal credentials and other sensitive data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You Google “Xenon Client download,” click the top result, and boom, WeedHack just rode in with your Minecraft mod. The site looks perfect, branding, FAQs, even real GitHub links, but that big Download button is a malicious JAR. WeedHack steals Minecraft session IDs, browser passwords, cookies, even crypto wallet data. McAfee still saw over 6,300 hits to these fake WeedHack sites in a month, mostly through Discord and MediaFire links. The trick: they abuse trusted platforms, so the Discord or Dropbox logo makes the file feel safe. Here’s the move: before you run any Minecraft mod or client JAR, ignore the search rank and the platform logo, go to the project’s official site or release page yourself and only download from there.
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
Attackers are tricking Minecraft players into downloading malware by impersonating popular Minecraft clients and resellers in Google search results. Even after the campaign’s command-and-control infrastructure was taken down, the operation continued by shifting distribution to common file-hosting…
The article highlights real, ongoing campaigns where attackers trick people into installing malware via fake software-download websites and a disguised browser extension. These lures are used to steal credentials, browser cookies, and authenticated sessions, letting attackers take over accounts…
Researchers documented a malware campaign that uses a fake business-proposal disk image to trick Windows users into opening a shortcut disguised as a Word document. The shortcut shows a legitimate-looking PDF while silently installing CikaBika Bot, which lets attackers control the device through…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
