If you’ve ever grabbed a “must-have” Minecraft client from a YouTube link at 1 a.m., you’re not alone. That’s exactly the moment campaigns like WeedHack count on. McAfee telemetry shows WeedHack has hit 116,464 systems, with victims concentrated in the US, Germany, India, and the UK, and it’s not slowing down . It hides an infostealer inside mods, clients, and cheats, then uses trust tricks to look legit. Let’s break down how it works, what it steals, and the steps that actually keep your account (and your device) safe.
What WeedHack is (and why it’s spreading so fast)
WeedHack is a Minecraft-focused Malware-as-a-Service (MaaS) campaign that disguises itself as mods, hacked clients, and game utilities to infect players' computers. First identified by McAfee Labs in January 2026, WeedHack has compromised over 116,000 systems across the US, Germany, India, and the UK, averaging 2,000 to 3,000 new infections per day. It operates through a clear-net dashboard that lets paying customers steal Minecraft session IDs, browser passwords, and system credentials, or, on the paid tier, take live control of a victim's webcam and PC. This article explains how WeedHack spreads, what it steals, and how to protect your account.
How WeedHack Actually Infects Your System
WeedHack delivers a malicious Java Archive file, identified by researchers as DonutDupe.jar, disguised as a mod or hacked client. Once launched, the file kicks off a multi-stage chain: Windows Defender is disabled first, then system information is harvested, and two additional payloads are dropped to establish persistence and open a remote-access channel.
The campaign deliberately targets users searching for specific Minecraft clients by name, including Meteor Client, Wurst Client, LiquidBounce, Radium Client, Future Client, and Aristois, by poisoning search results and YouTube with convincing lookalike download sites.
Even the free tier of WeedHack is extensively capable: it can steal passwords and cookies from 36 browsers, drain credentials from 56 browser-based cryptocurrency wallets and 12 desktop wallets, harvest Discord, Steam, and Telegram tokens, capture screenshots, and exfiltrate Minecraft session IDs across multiple launchers. The paid tier (reported at $4.99/month via Telegram channels) adds webcam access, keylogging, and full reverse-shell execution.
Why Minecraft players are a perfect target
Attackers go where the clicks are, and Minecraft has a few built-in risk factors:
- “Quick download” habits: You see a new client, you want it now, and a random JAR feels normal because mods are JARs.
- Mod FOMO: If friends are talking about a client or an “FPS boost,” waiting to verify sources feels like missing out.
- Accounts are worth real money: A stolen Minecraft account can mean lost cosmetics, access to servers, and a clean identity attackers can reuse.
- Gamers are logged into everything: Discord, Steam, browsers, password managers, even crypto wallets on the same PC—exactly what infostealers hunt for .
The other accelerant is accessibility. McAfee notes WeedHack is hosted on the clear net and offers free access to the platform (unusual for infostealer operations), plus a payload builder targeting Minecraft versions 1.21.0 through 1.21.10 . In plain English: it lowers the skill barrier, so more people can run the scam.
And once you accept that, the next question becomes obvious: how are they getting so many players to install it willingly?
How the trap works: YouTube links, SEO-poisoned pages, and fake trust signals
WeedHack doesn’t win by “hacking” Minecraft. It wins by being easy to install and showing up right where players already look for downloads: YouTube and Google.
Path #1: YouTube “download links” (the fastest click)
McAfee’s research points to a simple pattern: videos that show off a Minecraft tool, then drop the payload link in the video description or comments .
What makes this work is that the content can feel legit:
- Some videos are well-made, with voice-over narration meant to signal “real creator, real tool” .
- They can rack up views (McAfee observed examples with 7,500+ views) which lowers your guard .
If you’ve ever thought “it has thousands of views, it’s probably fine,” that’s the mental shortcut they’re aiming for.
Path #2: SEO poisoning for “client download” keywords
The second lane is SEO poisoning: attackers push malicious pages to rank for popular searches like Minecraft client download. McAfee notes this targeting includes well-known client keywords such as Meteor Client, Wurst Client, LiquidBounce, Impact Client, and others .
Why this works so well in the Minecraft mod scene:
- A lot of these projects don’t have official websites, and may live mainly on GitHub .
- That leaves space for lookalike “download” sites to step in and pretend they’re the main source.
The trust trick that catches careful people too
The sneaky part isn’t just the ranking. It’s the “safety theater.”
McAfee describes a case where a malicious site posts a security notice telling visitors to only download a mod (example: Skytils) from the official site—then it links to the project’s real GitHub repo and Discord server to create a false sense of verification .
So you land on a page that:
- Sounds security-aware
- Name-drops the “official” sources
- Still routes you to the attacker’s download
That’s the trap in one line: they borrow real community trust (GitHub + Discord) to make a bad JAR feel normal.
What it steals: the “free tier” damage is already brutal
Once that “verified” download runs, WeedHack doesn’t wait for you to log into anything. It starts pulling data that’s already sitting on your machine and in your browsers.
McAfee’s reporting is blunt here: even the free tier is a full-on infostealer, aimed at Minecraft session IDs, browser data, chat apps, and crypto wallets .
What the free tier targets (plain English)
Here’s what WeedHack goes after, based on McAfee’s analysis :
- Minecraft session IDs
Think of this like a “proof that you’re logged in” token. If someone steals it, they may not need your password to act like you. - Cookies + saved passwords across 36 browsers
Cookies can keep you logged in. Saved passwords are exactly what they sound like: ready-to-use keys. - Crypto extensions and wallet apps
The free tier targets 56 cryptocurrency add-ons and 12 desktop cryptocurrency wallet apps . - Discord / Steam / Telegram credentials
These are the accounts that let attackers spread fast, impersonate you, and hit your friends. - Screenshots
This is the stuff people forget matters until it’s gone: DMs open on screen, recovery codes, billing pages, wallet apps, server admin panels.
What that turns into in real life
This isn’t “they stole some files.” It’s usually one of these outcomes:
- Minecraft account takeover (session hijack is enough in some cases)
- Discord hijack → your account spams “download this mod” links to friends/servers
- Steam/Telegram compromise → more impersonation, more spread
- Wallet drain attempts if you’ve ever used crypto extensions/apps on that PC
Even if you catch it quickly, the damage can keep rolling because stolen cookies and sessions don’t always die when you change one password.
When it gets worse: premium features that turn a mod into remote control
The free tier is already enough to wreck accounts. The premium tier is where it stops being “an infostealer from a Minecraft mod JAR” and starts looking like remote access malware.
McAfee reports WeedHack offers a paid tier ($5/month or a one-time lifetime option) that adds hands-on control of the victim’s machine . At that point, the attacker doesn’t just take what’s stored on your device—they can operate your device.
What “premium” actually adds
According to McAfee, WeedHack’s premium tier includes :
- Remote control with input access (mouse + keyboard)
That’s literal control of what you click, type, and open. - Webcam access
If you have a camera connected, that risk isn’t theoretical. - Keylogger
Even if you don’t save passwords in your browser, a keylogger can still catch what you type. - Remote shell
A command-line backdoor. It lets attackers run commands quietly, without the normal “open an app, click around” traces. - Remote file management
Upload, download, browse, and move files. That’s a straight line to personal docs, game folders, screenshots, and anything else on disk.
A simple risk lens: it’s not a Minecraft problem anymore
Once mouse/keyboard control and a remote shell are in play, the threat shifts:
- Your PC becomes the target, not your Minecraft account.
- Any account you log into later can be grabbed (keylogger).
- Cleanup gets harder, because the attacker can change things after the initial infection.
If the “mod” you installed can watch your screen, log your keystrokes, and control your inputs, you’re dealing with a full-device security incident—not a bad download.
A practical defense checklist (before and after you mod)
If WeedHack proves anything, it’s that “it’s just a Minecraft mod JAR” is a dangerous sentence. Treat mod installs like installing software, because that’s what you’re doing.
Before you download: stop the bad JAR before it runs
McAfee’s advice is simple and correct: only trust mods from official project sources, verify download links, and treat JAR files hosted on dubious sites with caution .
Use this checklist:
- Start from the project’s real home base
- Prefer the project’s official GitHub (releases page, not random “download” mirrors).
- If a project uses Discord, use it only to confirm links, not to grab mystery attachments.
- Be allergic to “one-click” download pages
- If a site is pushing a “launcher,” “installer,” or “client” bundle when you expected a simple mod file, pause.
- If the page tries hard to look security-aware, treat that as a red flag. Attackers copy that vibe on purpose.
- Default to safer content when you can
- If your goal is just to expand gameplay (skins, worlds, add-ons), the in-game Minecraft Marketplace is the safest option .
After a sketchy install: contain damage like it already happened
If you ran a JAR and you’re even slightly unsure, act fast. Infostealers don’t need days.
- Disconnect and scan
- Get off Wi‑Fi/Ethernet if you can.
- Run a trusted security scan and remove anything flagged.
- Rotate passwords from a clean device
- Prioritize: email account first, then Microsoft/Mojang, then Discord, Steam, and any crypto-related accounts.
- Kill active sessions
- Log out of sessions wherever the service supports it (email, Discord, Microsoft, Steam). This helps even when cookies/session tokens were taken.
- Lock down Discord and Steam
- Enable 2FA, review authorized apps, and check for new devices/logins.
- Warn friends if your account posted links. That’s how these campaigns keep looping.
What To Do If You Already Installed a WeedHack Mod
If you downloaded a Minecraft mod from YouTube, Discord, or an unofficial site and you are not certain it is clean, treat it as a potential WeedHack infection immediately.
Step 1: Disconnect from the internet to stop any active data exfiltration.
Step 2: Do not open your browser or any password manager until you have scanned the device.
Step 3: Run a full system scan with updated antivirus software. McAfee and Windows Defender (after a manual re-enable) can detect known WeedHack JAR variants.
Step 4: Check your Minecraft mod folder and delete any .JAR files you did not intentionally install from a verified source.
Step 5: Change your Minecraft account password and revoke active sessions from the official Minecraft account page.
Step 6: Change passwords for any browser-saved accounts, especially Discord, Steam, and banking credentials.
Reduce fallout next time: separate identities on purpose
A lot of real-world damage comes from one compromise cascading into five accounts.
One practical way to limit that blast radius is using masked emails and phone numbers for sign-ups, so a leak from one community site doesn’t automatically expose your primary inbox/number. Tools like Cloaked are built for this: you can create aliases for email/phone and keep your real contact info out of random mod forums, Discord servers, and download sites.
