YouTube and SEO Poisoning Spread WeedHack Minecraft Malware

Key Takeaways

• A malicious campaign dubbed “WeedHack” is distributing Minecraft malware through deceptive YouTube videos and sophisticated SEO poisoning techniques.
• The malware functions as a Malware-as-a-Service (MaaS) platform, enabling threat actors to steal credentials from over 36 browsers and 56 crypto wallets, along with Discord, Steam, and Telegram login details.
• Active since January 2026, WeedHack has already compromised more than 116,000 victims globally, with a daily infection rate of 2,000 to 3,000 new systems.
• The campaign is notable for employing EtherHiding, a technique that leverages the Ethereum blockchain to conceal its command-and-control infrastructure, making it exceptionally resilient to takedowns.
• Victims, many of whom are teenagers, are also being subjected to cyberbullying and harassment, including the recording and sharing of hijacked webcam footage.

A widespread and sophisticated malware campaign, identified as “WeedHack,” is actively targeting Minecraft players by embedding malicious code within seemingly legitimate game modifications and clients. Threat actors are utilizing carefully crafted YouTube videos and advanced search engine optimization (SEO) poisoning to lure unsuspecting users into downloading the malware.

Operating since January 2026, the WeedHack campaign has already impacted over 116,000 victims worldwide. Its insidious nature is compounded by its availability as a Malware-as-a-Service (MaaS) platform, allowing even novice attackers to deploy its potent capabilities.

The free version of WeedHack alone is capable of extracting passwords from 36 different web browsers, compromising credentials from more than 56 browser-based cryptocurrency wallets, and pilfering login information for popular platforms such as Discord, Steam, and Telegram.

McAfee Labs analysts, who detailed their findings in a report shared with Cyber Security News (CSN), uncovered the full extent of this operation. Their investigation revealed over 3,820 unique malicious JAR files and more than 240 active URLs distributing the malware, resulting in approximately 2,000 to 3,000 new infections daily. The United States, Germany, India, and the United Kingdom are the most heavily affected regions.

A particularly disturbing aspect of this campaign is the demographic of its users. Researchers discovered that many individuals deploying WeedHack appear to be teenagers and young adults. These operators are not only stealing accounts but are also engaging in harassment and bullying, recording victims via compromised webcams and sharing these private videos in Telegram channels as a form of “cybercrime bragging.”

Hackers Use YouTube and SEO Poisoning

WeedHack propagates primarily through two channels: fraudulent YouTube content and SEO manipulation. Threat actors produce high-quality YouTube videos, often featuring voiceovers, that showcase fabricated Minecraft mods and clients. One such video garnered over 7,500 views and contained a direct link to a malicious download site in its description.

The campaign strategically targets Minecraft mods lacking official web presence, allowing the malicious sites to dominate search engine results for relevant keywords. These counterfeit websites are meticulously designed to appear authentic, some even featuring fake security warnings that instruct users to download only from their page, and linking to legitimate Discord servers and GitHub repositories to enhance their credibility.

Beyond video content, WeedHack’s operators are instructed to participate in Discord and Reddit communities to subtly promote their malicious links. The WeedHack dashboard itself provides comprehensive tutorials on effectively employing both YouTube and SEO strategies, including guidance on keyword targeting and avoiding detection.

EtherHiding and Multi-Stage Payload Delivery

A distinctive technical feature of WeedHack is its utilization of EtherHiding, a technique that stores the malware’s command-and-control (C2) server address on the Ethereum blockchain. This approach significantly complicates infrastructure takedowns, as the C2 address is dynamically retrieved from a blockchain smart contract rather than being hardcoded within the malware. Furthermore, C2 responses are RSA-signed, preventing unauthorized parties from hijacking the campaign’s communication.

Upon execution of an infected JAR file, the malware initiates a four-stage infection process. The initial stage securely retrieves the C2 domain from the blockchain. The second stage then loads an obfuscated payload directly into memory using a custom class loader. The subsequent third and fourth stages establish persistence on the compromised system and deploy a suite of remote access tools, including webcam access, keylogging capabilities, and a reverse shell.

The malware also deploys a script that adds numerous exclusion paths to Windows Defender, effectively neutralizing the built-in antivirus. A persistent watchdog task, executed every two minutes, ensures the restoration of any deleted malware components, rendering manual removal exceptionally challenging without specialized tools.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Exercise Extreme Caution with Downloads: Only download Minecraft mods, clients, or any software from official, verified sources. Be highly suspicious of links found in YouTube video descriptions, forum posts, or unofficial websites.
• Verify Sources: Before downloading, thoroughly research the mod or client and its developers. Look for established communities, official documentation, and positive reviews from reputable sources. Avoid sites that appear newly created or have generic content.
• Update Security Software: Ensure your antivirus and anti-malware software is always up-to-date and configured for real-time protection. While WeedHack attempts to bypass Windows Defender, a robust third-party solution may offer additional protection.
• Enable Multi-Factor Authentication (MFA): Activate MFA on all your online accounts, especially for gaming platforms, social media, and cryptocurrency wallets. This adds a crucial layer of security, even if your login credentials are stolen.
• Educate Yourself and Others: Be aware of common social engineering tactics used by threat actors, such as enticing offers of free game items or exclusive features. Discuss these risks with younger users who may be more susceptible.
• Report Suspicious Activity: If you believe you have downloaded malware or are being targeted, immediately disconnect from the internet

  Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

  Tags:

  AttackHackerMalwareSecurityThreat