[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fV23wzmmgczSY9HGLFzIXrdeH4IlEJlGs_XMa_YLA1mM":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":29,"category":30,"article_tags":34},"4cad55ca-4335-43c6-b211-18ef359f9c03","Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning","weedhack-malware-spreads-via-fake-minecraft-clients-and-seo-poisoning-5b092e","Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Minecraft clients. McAfee Labs said it detected and blocked more than 6,300 attempts to access malicious sites, adding that it found lookalike gaming websites designed to mimic legitimate projects, including branding, feature lists, FAQs,","Cybersecurity researchers have identified that the Weedhack malware is being actively distributed to gamers through fake Minecraft client websites. These sites mimic legitimate projects using AI-powered builders and SEO poisoning to outrank official sources. McAfee Labs detected over 6,300 attempts to access these malicious sites, which deploy JAR payloads to steal system information and sensitive data.","Weedhack malware spreads via fake Minecraft clients and SEO poisoning.","Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning Ravie LakshmananAug 24, 2026Malware \u002F SEO Poisoning Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Minecraft clients. McAfee Labs said it detected and blocked more than 6,300 attempts to access malicious sites, adding that it found lookalike gaming websites designed to mimic legitimate projects, including branding, feature lists, FAQs, installation guides, developer credits, and links to genuine GitHub repositories. Notably, one of the sites has been built using Lovable, an artificial intelligence (AI)-powered website builder, highlighting how readily available tools can further lower the barrier and make it easier to launch convincing new malicious sites. Weedhack was first documented by the cybersecurity company back in June 2026, detailing its use of SEO poisoning and YouTube to redirect traffic to the bogus domains. The attack triggers a multi-stage sequence that culminates in the deployment of JAR payloads that can collect system information, set up Microsoft Defender exclusions, and steal sensitive data from the compromised host. \"Nearly half of the malicious URLs identified were Discord links (49.6%), followed by MediaFire (23.4%) and GitHub (8.2%), showing how attackers can use familiar platforms alongside fake websites to distribute malware,\" McAfee Labs researcher Aayush Tyagi said. Some of the fake domains distributing the malware are listed below - glazed-client[.]com, which replicates glazedclient[.]com, a free and open-source Minecraft add-on of the same name radium-client[.]com, which replicates radiumclient[.]com, a paid Minecraft client seedcrackerx.github[.]io, which replicates seedcrackerx[.]com, a Minecraft seed cracking software cheatlib[.]xyz, which claims to be a \"modern Minecraft mod library\" with more than 1.6 million downloads meteorclients[.]com, which replicates meteorclient[.]com 22qq-client[.]com, which impersonates a Minecraft mod of the same name for Crystal PvP servers kryptonclientcrack.lovable[.]app, which replicates kryptonclient[.]org, a paid Minecraft tool for DonutSMP server nova-client[.]com, which impersonates an open-source Minecraft client xenoclient[.]lol and xenonclient[.]com, which impersonate Xenon client It's worth noting that both the websites for Xenon Client and Nova Client feature at the top of search results across various search engines like Google, Microsoft Bing, Brave Search, and DuckDuckGo, allowing unsuspecting users to download Weedhack-laced clients. \"The legitimate client is hosted on GitHub and Modrinth; however, attackers have created a spoofed website and leveraged SEO poisoning techniques to outrank the official sources in search results,\" McAfee Labs said. Besides bogus domains, file hosting services and GitHub repositories have been observed spreading Weedhack, with links to these websites distributed via Discord, Reddit, and other communication channels. Another propagation channel involves hosting the JAR files on Planet Minecart and EndMods, both of which are legitimate destinations for Minecraft tools and enhancements. To counter the threat, it's advised to keep devices up-to-date, stick to trusted sources, scan files before opening them, and exercise caution when any mod or cheat prompts to disable security protections before installing it. This is not the first time SEO poisoning campaigns for popular tools are being used to drop malware. In June 2026, Check Point flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting users through a Traffic Distribution System (TDS) and deliver malware families like Remus Stealer, AnimateClipper, and the SessionGate framework. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  AI Security, Cybercrime, data theft, endpoint security, Gaming Security, Malware, Search Security, SEO poisoning, Threat Intelligence, Web Security ⚡ Top Stories This Week Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments CDN Tsunami Attack Abuses HTTP\u002F3 Translation for Up to 350x DoS Amplification Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits\u002FSecond OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps AI \"Mind Viruses\" Can Spread Between Agents Through Persistent Prompt Files SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE Attackers Exploit SharePoint Authentication Bypass After Public PoC Release Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access ⭐ Featured Resources See How Keeper Secrets Manager Removes Hard-Coded Credentials Download the CISO's Guide to Smarter AI Security Investment Phishing Is Costing Security Teams More Than Ever — Read the New Report Build AI Agents and Automations Without Losing Security Control","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fweedhack-malware-spreads-via-fake.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgM9ML6Oc83309fnrqC5YOyteVjfKTYCzrm3KoKbrmts4w0P7kQoBMu9btpIWFoYZePuTnU0TL7Olt7jVqdJylmuxwKcI0_NaKNuHxe0pQwi6W2mz7D-qS4WvW1da7E-QG2eEfNf-MbqmB3GR0psJTTT8RO-NtFnx9yVe8dlItdO2G0Dh4wXFNLs_WIqAHP\u002Fs1600\u002Fmine.jpg","2026-08-24T17:41:11+00:00","2026-08-25T00:00:06.916864+00:00",8,[18,21,24,27],{"name":19,"type":20},"Minecraft","product",{"name":22,"type":23},"McAfee","vendor",{"name":25,"type":26},"SEO poisoning","technology",{"name":28,"type":26},"AI","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,37,42],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,54,57,60,62,65,68,70,73],{"type":49,"value":50,"context":51},"domain","glazed-client[.]com","Fake Minecraft client website distributing Weedhack",{"type":49,"value":53,"context":51},"radium-client[.]com",{"type":49,"value":55,"context":56},"seedcrackerx.github[.]io","Fake Minecraft seed cracking software website distributing Weedhack",{"type":49,"value":58,"context":59},"cheatlib[.]xyz","Fake Minecraft mod library website distributing Weedhack",{"type":49,"value":61,"context":51},"meteorclients[.]com",{"type":49,"value":63,"context":64},"22qq-client[.]com","Fake Minecraft mod website distributing Weedhack",{"type":49,"value":66,"context":67},"kryptonclientcrack.lovable[.]app","Fake Minecraft tool website distributing Weedhack",{"type":49,"value":69,"context":51},"nova-client[.]com",{"type":49,"value":71,"context":72},"xenoclient[.]lol","Fake Xenon client website distributing Weedhack",{"type":49,"value":74,"context":72},"xenonclient[.]com"]