Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

Cybersecurity researchers at McAfee Labs have identified a campaign where malicious websites disguised as legitimate Minecraft clients are distributing the Weedhack malware. These sites, leveraging SEO poisoning and mimicking real Minecraft projects, are driving downloads of a multi-stage malware payload that collects system information, disables security protections, and steals sensitive data. The campaign utilizes various platforms like Discord, MediaFire, and GitHub to spread the threat, and is not an isolated incident, as similar SEO poisoning tactics were used in June 2026 to deliver malware like Remus Stealer.