Date: 08/21/2026
Severity: High
Summary
The WeedHack campaign is a Malware-as-a-Service (MaaS) operation that targets Minecraft players through fake gaming websites, SEO poisoning, and YouTube lures distributing malicious mods and clients. The multi-stage Java malware uses EtherHiding for C2 resolution, disables Microsoft Defender, establishes persistence, and steals browser credentials, Discord, Steam, Telegram, cryptocurrency wallets, and Minecraft accounts. The campaign demonstrates large-scale credential theft and remote access capabilities while lowering the barrier to entry for cybercriminals through a MaaS model.
Indicators of Compromise (IOC) List
Domains/Urls | https://glazed-client.com/ https://github.com/Hl3n/GambleRigMod https://www.radium-client.com/ https://discord.com/channels/1467145812906872834/ https://seedcrackerx.github.io/ https://github.com/seedcrackerx/seedcrackerx.github.io https://xenonclient.com/ https://xenoclient.lol https://nova-client.com/ https://cheatlib.xyz/ https://discord.com/channels/1478170973755936990 https://meteorclients.com http://22qq-client.com/ https://kryptonclientcrack.lovable.app https://github.com/lsellh/ https://static.planetminecraft.com/files/resource_media/mod/mousetweaks-fabric-mc1-21-9-2-29.jar https://static.planetminecraft.com/files/resource_media/mod/no-delay-optimizer1-21-4.jar https://endmods.com/wp-content/uploads/2026/02/KRYPTON-CLIENT1.0.zip |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://xenoclient.lol" or url like "https://xenoclient.lol" or siteurl like "https://xenoclient.lol" or domainname like "https://discord.com/channels/1478170973755936990" or url like "https://discord.com/channels/1478170973755936990" or siteurl like "https://discord.com/channels/1478170973755936990" or domainname like "https://static.planetminecraft.com/files/resource_media/mod/mousetweaks-fabric-mc1-21-9-2-29.jar" or url like "https://static.planetminecraft.com/files/resource_media/mod/mousetweaks-fabric-mc1-21-9-2-29.jar" or siteurl like "https://static.planetminecraft.com/files/resource_media/mod/mousetweaks-fabric-mc1-21-9-2-29.jar" or domainname like "https://glazed-client.com/" or url like "https://glazed-client.com/" or siteurl like "https://glazed-client.com/" or domainname like "http://22qq-client.com/" or url like "http://22qq-client.com/" or siteurl like "http://22qq-client.com/" or domainname like "https://kryptonclientcrack.lovable.app" or url like "https://kryptonclientcrack.lovable.app" or siteurl like "https://kryptonclientcrack.lovable.app" or domainname like "https://meteorclients.com" or url like "https://meteorclients.com" or siteurl like "https://meteorclients.com" or domainname like "https://github.com/seedcrackerx/seedcrackerx.github.io" or url like "https://github.com/seedcrackerx/seedcrackerx.github.io" or siteurl like "https://github.com/seedcrackerx/seedcrackerx.github.io" or domainname like "https://cheatlib.xyz/" or url like "https://cheatlib.xyz/" or siteurl like "https://cheatlib.xyz/" or domainname like "https://static.planetminecraft.com/files/resource_media/mod/no-delay-optimizer1-21-4.jar" or url like "https://static.planetminecraft.com/files/resource_media/mod/no-delay-optimizer1-21-4.jar" or siteurl like "https://static.planetminecraft.com/files/resource_media/mod/no-delay-optimizer1-21-4.jar" or domainname like "https://discord.com/channels/1467145812906872834/" or url like "https://discord.com/channels/1467145812906872834/" or siteurl like "https://discord.com/channels/1467145812906872834/" or domainname like "https://seedcrackerx.github.io/" or url like "https://seedcrackerx.github.io/" or siteurl like "https://seedcrackerx.github.io/" or domainname like "https://www.radium-client.com/" or url like "https://www.radium-client.com/" or siteurl like "https://www.radium-client.com/" or domainname like "https://endmods.com/wp-content/uploads/2026/02/KRYPTON-CLIENT1.0.zip" or url like "https://endmods.com/wp-content/uploads/2026/02/KRYPTON-CLIENT1.0.zip" or siteurl like "https://endmods.com/wp-content/uploads/2026/02/KRYPTON-CLIENT1.0.zip" or domainname like "https://nova-client.com/" or url like "https://nova-client.com/" or siteurl like "https://nova-client.com/" or domainname like "https://github.com/Hl3n/GambleRigMod" or url like "https://github.com/Hl3n/GambleRigMod" or siteurl like "https://github.com/Hl3n/GambleRigMod" or domainname like "https://xenonclient.com/" or url like "https://xenonclient.com/" or siteurl like "https://xenonclient.com/" or domainname like "https://github.com/lsellh/" or url like "https://github.com/lsellh/" or siteurl like "https://github.com/lsellh/" |
Reference:
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning/