Executive Summary
McAfee Labs has identified a significant Malware-as-a-Service (MaaS) operation dubbed 'Weedhack' that specifically targets the Minecraft gaming community. Since January 2026, the campaign has successfully accumulated over 116,000 hits by masquerading as popular game mods and clients. The threat actor lowers the barrier to entry for cybercrime by offering a free tier for credential theft and a low-cost premium tier ($5/month) for advanced Remote Access Trojan (RAT) capabilities, resulting in widespread use by younger individuals for activities such as cyberbullying and account hijacking.
Technically, Weedhack is notable for its use of 'EtherHiding,' a technique where the malware queries the Ethereum blockchain via JSON-RPC servers to retrieve its latest command-and-control (C2) domains. The attack chain involves four distinct stages of JAR payloads, utilizing JNIC for native obfuscation and CMSTP for UAC bypass. Beyond Minecraft session IDs, the malware steals Discord tokens, browser cookies, passwords, and cryptocurrency wallet data from dozens of applications.
Key Details
Threat Name
Weedhack MaaS Campaign
Affects
—
Adversary
Weedhack
MITRE Techniques
Malware/Tools
Weedhack, Lumma Stealer, X-worm, DonutDupe.jar, Elevator.jar, SecurityManager.jar, Component.jar, RuntimeBroker.exe, Telemetry.exe