WeedHack lost its C2 and kept its funnel: ten fake Minecraft sites still convert victims
McAfee says the WeedHack stealer's control server is dead and its renter dashboard gone, but ten impersonation sites and the search rankings behind them are still delivering victims.
The Watch · Security desk
What happened
- McAfee Labs says ten malicious sites and several file-hosting accounts are still distributing the WeedHack infostealer after its command-and-control infrastructure was disrupted.
- The company's WebAdvisor product blocked more than 6,300 attempts by its own users to reach those sites in the past month.
- The service had run a free tier open to anyone with a Discord account and a premium tier with webcam surveillance at $5 a month.
- Counterfeit Xenon Client and Nova Client sites sit at the top of Google, Bing, Brave and DuckDuckGo results, above the projects' GitHub and Modrinth listings.
- The delivered JAR payloads collect system information and add Microsoft Defender exclusions before stealing data from the host.
Why it matters
- What it limits constraint Killing the control server and dashboard leaves the operators needing a new host, not a new audience; recovery for them is a rental, not a rebuild.
- What it costs cost The costly asset in this campaign is search position, and while it stands the victim count keeps accruing against a disruption already booked as a result.
- Who's exposed exposure Open-source Minecraft projects that never registered a domain have no brand estate to defend, and the impersonation ranks above the repository they do control.
- Who has to decide decision Because intake now runs on mainstream file-sharing and chat accounts plus rankings, the next meaningful takedown is a moderation and search decision rather than a hosting one.
Next story · Security · 5h ago
Aoki infostealer adds AI coding assistant tokens and AWS keys to its target list, Symantec saysConfirmed2 publishers
The half of WeedHack that went dark is the half that is cheap to replace. McAfee says the operation pulled its live server address out of the Ethereum blockchain using EtherHiding, a design whose entire purpose is to make the loss of any single host survivable [16]. The vendor nonetheless reports that after its early-July writeup the C2 stopped answering and the renter-facing dashboard vanished [7]. What did not go anywhere is the acquisition layer: pages detailed enough to reproduce a real tool's feature list, FAQ, install steps, developer credits and links back to the genuine GitHub repository [10].
The June figures reward a little division. McAfee logged 116,464 infected systems since January and put daily intake at 2,000 to 3,000 [9]. At that rate the entire cumulative total represents 39 to 58 days of work [23], against roughly five months of operation, so the pace that made the original report alarming belongs to the period after the distribution network matured rather than to the malware's debut. The stealer was never the scarce input.
The 6,300 blocked attempts work out to about 210 a day [17], and that counts only McAfee-protected users bouncing off ten known domains [1][2]. It does not count JAR files hosted on Planet Minecraft and EndMods, both legitimate destinations for Minecraft tools [13], nor the link sprawl on the services doing most of the delivery: Discord at 49.6 percent of catalogued malicious URLs, MediaFire 23.4, GitHub 8.2, Dropbox 4.6 [6], which is 85.8 percent sitting on four platforms users have no reason to distrust [18].
The impersonation succeeds partly because much of the target ecosystem never had a website to impersonate. Nova Client is an open-source project without one, so the attackers built the missing site and ranked it above the repository [11]. McAfee's cleanest tell on that page is a credits section listing generic team names instead of the people who wrote the code [12]. Where a real site does exist, the clone sits on top of it: the first two Google results for "Xenon Client" led to fake sites, according to McAfee [4]. One domain in the set was assembled with the AI website builder Lovable, which puts the cost of the next convincing clone close to zero [5]. Volume is cheap by other routes too, with one Discord channel pushing fake DonutSMP clients carrying more than 1,900 members [20] and a single site listing eight separate mods that all delivered the same malware [21].
None of this is particular to Minecraft. Check Point documented a comparable operation in June 2026 that impersonated open-source and freeware projects and routed visitors through a traffic distribution system to deliver Remus Stealer and other families [22]. McAfee's own advice concedes where the leverage is by being a routing rule rather than a detection one: take mods from the developer's repository or from Modrinth and CurseForge, and read a prompt to disable antivirus as the payload identifying itself [8].
What to watch
- Whether the ten named domains lose registration or simply cycle out of the top results while replacements rank in their place.
- Whether a replacement C2 surfaces through the Ethereum lookup and daily infection counts return to the 2,000 to 3,000 range.
- Whether Discord, MediaFire, GitHub, Dropbox and Lovable act on the specific accounts and pages McAfee identified.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption40
- Hype gap+15
- Incentives55
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 18%
- Operator
- Operator 77%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
McAfee Labs published a follow-up report documenting ten active malicious sites and multiple file-hosting accounts still spreading the WeedHack infostealer despite a disruption to its command-and-control infrastructure.
- [2]
Over the past month McAfee WebAdvisor blocked more than 6,300 user attempts to reach the malicious sites.
- [3]
The fake sites for Xenon Client and Nova Client appear at the top of results across Google, Microsoft Bing, Brave Search and DuckDuckGo, while the legitimate client is hosted on GitHub and Modrinth and has been outranked through SEO poisoning.
- [4]
Researchers found the first two Google results for "Xenon Client" led to fake sites distributing WeedHack.
- [5]
One site in the campaign was built using lovable.app, an AI-powered web application builder, which researchers said lowers the cost and skill needed to launch a convincing fake gaming site to close to zero.
- [6]
Most malicious links came through Discord (49.6%), followed by MediaFire (23.4%), GitHub (8.2%) and Dropbox (4.6%).
- [7]
McAfee said that following publication of its original article in the first week of July, WeedHack's campaign was disrupted and its C2 server is no longer active; the operator dashboard is gone while the distribution sites remain.
- [8]
McAfee recommends downloading mods and clients only from official developer repositories or trusted platforms such as Modrinth and CurseForge, and treating any tool that asks users to disable antivirus as malware.
- [9]
The operation had been running since January and had logged 116,464 infected systems, adding between 2,000 and 3,000 new victims every day.
- [10]
Each fake website copies the real tool's features, FAQs, installation steps, developer information and links to legitimate GitHub repositories.
- [11]
Many popular Minecraft tools have no official website, only GitHub pages and Discord servers; nova-client.com is a fake site for a client with no real website, which the attackers built and ranked above the genuine GitHub repository.
- [12]
On nova-client.com the credits section lists generic team names rather than anyone who actually worked on the project, which researchers noted as one of the cleaner ways to spot the impersonation.
- [13]
The campaign also spread by hosting JAR files on Planet Minecraft and EndMods, both legitimate destinations for Minecraft tools.
- [14]
The operation offered a free tier accessible to anyone with a Discord account and a premium tier with webcam surveillance for $5 a month.
- [15]
A dashboard let operators view stolen credentials, configure custom payloads and monitor victims in real time.
- [16]
WeedHack used EtherHiding, fetching the attacker's active server address from the Ethereum blockchain, to maintain contact with its infrastructure even when individual servers were shut down.
- [17]
More than 6,300 blocked access attempts in a month is about 210 a day.
- [18]
Discord, MediaFire, GitHub and Dropbox together accounted for 85.8 percent of the malicious URLs McAfee catalogued.
- [19]
The attack triggers a multi-stage sequence culminating in JAR payloads that collect system information, set up Microsoft Defender exclusions and steal sensitive data from the host.
- [20]
One Discord channel promoting fake DonutSMP clients had more than 1,900 members.
- [21]
One site in the campaign offered eight different mods that all delivered the same malware.
- [22]
In June 2026 Check Point flagged a large-scale operation impersonating open-source and freeware projects that funnelled users through a Traffic Distribution System to deliver malware including Remus Stealer, AnimateClipper and the SessionGate framework.
- [23]
At the reported rate of 2,000 to 3,000 infections a day, the cumulative total of 116,464 systems equals roughly 39 to 58 days of intake, far short of the five months the operation had been running when it was found.
- [24]
WeedHack was first documented in early June 2026 by McAfee researcher Aayush Tyagi as a Malware-as-a-Service operation.
Sources
3 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comFake Minecraft Clients Deliver WeedHack Malware Despite Infrastructure Takedown
1 article · August 25, 2026
- securityaffairs.comFake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown
1 article · August 25, 2026
- thehackernews.comWeedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning
1 article · August 24, 2026
Topics and entities
Topics
- Infostealer Malware
- Minecraft modding
- SEO Poisoning
- Malware-as-a-Service
Entities
- Minecraft
- Check Point
- McAfee WebAdvisor
- EtherHiding
- Lovable
- Discord