Weedhack Malware Targets Minecraft Players in Credential Theft Campaign

A new cyber threat known as Weedhack is using popular Minecraft modifications to steal passwords, hijack gaming accounts, and spy on players through their webcams.

Operating as a Malware-as-a-Service (MaaS) since at least January 2026, this affordable toolkit has already recorded more than 116,000 successful infections.

At a starting price of just $5 per month, Weedhack makes it dangerously easy for amateur hackers to launch sophisticated attacks.

The malware spreads primarily through YouTube video promotions, search engine optimization (SEO) poisoning, and fake websites.

Attackers create professional-looking web pages that offer popular Minecraft modifications, such as Meteor Client, Wurst Client, LiquidBounce, and Impact Client.

By mimicking trusted software distribution platforms, they trick gamers into downloading infected files.

Weedhack Targets Minecraft Credentials

The attack begins when a victim downloads a malicious Java Archive (JAR) file disguised as a game mod. Once executed, the malware quietly restarts itself to hide any visible console windows from the user.

Weedhack stands out because it uses a technique called “EtherHiding” to maintain its operations. Instead of relying on traditional servers that can be easily blocked, the malware connects to the Ethereum blockchain to locate its command-and-control (C2) infrastructure.

It pulls this network data from smart contracts and verifies it using embedded cryptographic signatures. This decentralized approach makes it incredibly difficult for security researchers to disrupt the attackers’ network.

To evade antivirus detection, the malware’s next phase uses JNIC obfuscation, which converts Java code into native code.

The malware also prevents Windows Defender from applying system exclusions, keeping it undetected. Once settled in the system, the free tier of the malware goes on a data-stealing spree.

It targets passwords and cookies from 36 different web browsers, 56 browser-based cryptocurrency wallets, and 12 desktop crypto wallets.

It also harvests Discord tokens, Steam credentials, and Minecraft session IDs, allowing attackers to hijack accounts without needing the actual passwords.

For users who pay for premium tiers, Weedhack unlocks full remote-access capabilities. This allows the attacker to log keystrokes, manage files, share screens, and even access the victim’s webcam.

According to Polyswarm research, while Weedhack’s technical architecture is highly advanced, the way the malware is deployed is often deeply personal.

Security researchers observed that many Weedhack customers appear to be teenagers or young adults. Beyond traditional financial crimes like cryptocurrency theft, these users are weaponizing the malware for harassment and cyberbullying.

Using the premium remote-access tools, attackers are monitoring victims through their webcams and intimidating them.

In some cases, threat actors have stolen private images and videos from compromised computers and shared them within online criminal communities.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.