McAfee Labs has documented Weedhack, malware distributed through websites impersonating popular Minecraft clients. McAfee blocked more than 6,300 attempts to reach them.
The delivery is the interesting half.
The search results were the attack
SEO poisoning put the fake download pages above the official projects in Google, Bing, Brave and DuckDuckGo.
A user who did everything right — searched for the tool by name, did not click an ad, took the top organic result — landed on the attacker's site. There was no phishing email and no fake link in a chat. The search engine handed it over.
Nine fake domains were identified, impersonating Glazed Client, Radium Client, SeedCrackerX, Meteor Client, 22qq Client, Krypton Client, Nova Client and Xenon Client, on domains such as glazed-client[.]com and radium-client[.]com.
Where the files actually lived
The hosting split, per McAfee, is the part worth memorising:
| Platform | Share of malicious URLs |
|---|---|
| Discord | 49.6% |
| MediaFire | 23.4% |
| GitHub | 8.2% |
Nearly half the malicious URLs were Discord links. McAfee's researchers make the point directly: attackers use familiar platforms alongside fake websites to distribute malware.
That is the same structural problem as every campaign we have covered this month. A download from Discord or GitHub is indistinguishable at the network layer from the thousands of legitimate ones an organisation makes daily, and blocking the domain is not available to you. Distribution also ran through file hosts Planet Minecart and EndMods, YouTube redirect channels, and Reddit.
Then it blinds the defender
Once running, Weedhack collects system information, configures Microsoft Defender exclusions, steals sensitive data, and deploys JAR payloads in a multi-stage sequence.
The Defender exclusions step is the one to notice, and it is the third time this month the same move has appeared in a different form. SPECTRE unlinks EDR callbacks in the Windows kernel. A signed Defender driver can delete Defender at boot. Here the malware simply tells Defender not to look at the folder it lives in.
None of these defeat the product. They remove its ability to see, which produces the same silence as a clean machine — and that is the harder problem, because an absent alert is indistinguishable from safety.
Setting an exclusion requires administrator rights, which means a user who clicked through an elevation prompt for what they believed was a game mod.
Why the target matters
Minecraft clients are installed by people who are used to sideloading — the entire modding culture involves downloading executables from small independent projects, and antivirus warnings on legitimate mods are common enough that users are trained to click past them.
That is a population where "this is unsigned, continue anyway" is a normal Tuesday, and a large share of it is young.
The security advice that works for an enterprise — only install signed software from vendor sites — is close to unusable here, because the legitimate clients are unsigned software from small sites. Which is exactly why the technique was chosen.
What to do
- Type the project's URL or use a saved bookmark. Do not search for a client by name. The search result was the compromise in this campaign.
- Check Defender exclusions on any machine used for modding. They are in Virus & threat protection settings. An exclusion nobody remembers adding is a finding, and it is checkable in a minute.
- Treat a UAC prompt from a game mod as the decision point. A client does not need administrator rights to run.
- Do not trust a Discord link because a community trusts the poster. Half the malicious URLs here were Discord links.
- If you administer a household or a school, this is the campaign to explain in person. The population it targets does not read advisories.
What is not established
- How many devices were infected. McAfee reports blocked attempts, not victims — 6,300 blocks is a measure of one vendor's telemetry, not the campaign's reach.
- Which countries were affected. Not enumerated.
- Who operates it. No attribution.
- What data is stolen. Described as sensitive data; no specific targets named.
- Whether the fake sites are still ranking. The takedown status was not reported.
