Weedhack JARs Deploy Defender Exclusions and Data Theft via 6300+ SEO-Poisoned Minecraft Sites
Weedhack malware uses SEO-poisoned fake Minecraft clients to deploy JAR payloads that steal data and disable Defender. McAfee recorded 6300+ blocks with Discord and file hosts as primary vectors. The campaign exploits familiar gaming platforms and AI site builders, extending a broader pattern of open-source impersonation.
Weedhack arrives as multi-stage JARs that collect host data, add Microsoft Defender exclusions, and exfiltrate credentials and files. Delivery relies on 49.6% Discord links plus MediaFire and GitHub mirrors, with domains such as glazed-client.com and meteorclients.com impersonating legitimate projects while topping Google and Bing results. One site was generated via the Lovable AI builder, showing lowered entry costs for convincing spoofs.
Check Point documented a parallel June 2026 TDS campaign impersonating open-source tools to distribute Remus Stealer and SessionGate, indicating a repeatable pattern of SEO poisoning against gaming and dev communities. Planet Minecart and EndMods hosting further blurs trust boundaries, as players expect those platforms to vet uploads.
The operational effect hits gamers directly through stolen logins, financial data, and device persistence rather than abstract infrastructure threats. Routine mod searches now require verifying every GitHub link and disabling auto-install prompts that request security bypasses.
Next steps include sustained monitoring of Lovable-generated domains and search-engine demotion of known malicious mirrors; without that, detection volume will likely scale with new Minecraft releases.
McAfee: Weedhack blocks surpass 15000 monthly attempts by December 2026 if search rankings remain unchanged.
Sources (2)
- [1]Primary Source(https://thehackernews.com/2026/08/weedhack-malware-spreads-via-fake.html)
- [2]Supporting Source(https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-malware/)