Reported by 2 outlets
WeedHack Malware Spreads Through SEO-Poisoned Minecraft Sites Despite C2 Disruption
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
WeedHack Malware Spreads Through SEO-Poisoned Minecraft Sites Despite C2 Disruption
gbhackers.com · 49d ago · August 25th, 2026
A renewed distribution wave for the WeedHack malware-as-a-service operation, with threat actors continuing to push infected Minecraft clients and mods despite the campaign’s original command-and-control infrastructure being disrupted. The researchers found multiple active websites impersonating popular Minecraft projects, offering paid clients at no cost, and abusing well-known hosting platforms to make malicious downloads appear trustworthy. […] The post WeedHack Malware Spreads Through SEO-Poisoned Minecraft Sites Despite C2 Disruption appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Hackers Poison Google Search With Fake Minecraft Sites to Spread WeedHack Malware
cyberpress.org · 49d ago · August 25th, 2026
The campaign previously infected more than 116,000 gamers through a malware-as-a-service operation. Although McAfee’s earlier investigation disrupted the campaign’s command-and-control infrastructure, attackers are still using malicious websites and downloads to deliver WeedHack payloads. McAfee WebAdvisor blocked more than 6,300 attempts to access WeedHack-linked sites during the past month. The activity shows that shutting down malware infrastructure does not necessarily stop a campaign when threat actors can rapidly rebuild distribution channels. These sites copied legitimate branding, feature lists, FAQs, installation instructions, screenshots, developer credits, and links to real GitHub repositories. In many cases, every download button on a fake site delivered a JAR file or archive infected with WeedHack. Examples included domains impersonating Glazed Client, Radium Client, SeedCrackerX, Xenon Client, Nova Client, Meteor Client, and 22qq-client. glazed-client landing page (Source: mcafee) Some malicious sites offered paid Minecraft tools for free or advertised cracked versions of premium clients. In one notable case, McAfee researchers found the top two Google search results for “Xenon Client” leading to WeedHack distribution sites. This highlights how SEO poi