Fake Minecraft Downloads Are Pushing 'Weedhack' Malware to Gamers
McAfee Labs blocked more than 6,300 attempts to reach lookalike gaming sites that hand out malware instead of a cheat client.
Key points
- McAfee Labs detected and blocked more than 6,300 attempts to reach malicious sites distributing a malware family called Weedhack.
- The sites impersonate legitimate Minecraft cheat clients, copying their branding, feature lists and FAQ pages.
- Victims are gamers searching for free client downloads who end up installing malware that runs quietly on their PC.
- The campaign is still active, with fresh lookalike domains continuing to appear in search results.
- Anyone who downloaded a Minecraft client from an unfamiliar site recently should treat that machine as suspect.
Gamers hunting for free Minecraft add-ons are walking into a malware trap that's been running for months. Security researchers at McAfee say a family of malicious software called Weedhack is being distributed through websites that pretend to be legitimate Minecraft "clients", the tweaked versions of the game players use to add cheats or performance tweaks.
McAfee Labs told The Hacker News it detected and blocked more than 6,300 attempts by its own customers to reach these fake sites. That's only the traffic McAfee can see. The real number of victims is almost certainly higher.
How does the scam actually work?
Criminals build fake websites that look like real Minecraft cheat projects, then wait for players to find them through search engines. The pages reproduce the branding, feature lists and FAQ sections of the genuine tools they impersonate. To a teenager looking for a free download, the site looks entirely normal.
Instead of a game client, the download installs Weedhack quietly, giving attackers a foothold on the victim's machine. From there, the usual playbook applies: stealing saved passwords, grabbing session tokens for accounts like Discord, sometimes installing further payloads later.
SEO poisoning, tuning a site so it ranks near the top of Google results, is doing the heavy lifting. The failure mode is depressingly familiar. A kid searches "free Minecraft client download", clicks the first non-ad result, and hands their PC over. No phishing email required. We first reported on Weedhack being used against Minecraft players on 3 June 2026, and the delivery mechanic hasn't changed.
Why is Minecraft such a good lure?
Minecraft has a large, young player base that's very used to downloading unofficial software. Cheat clients, mod loaders and free-premium tools are a normal part of the culture, which makes it easy for criminals to blend in.
| Detail | What McAfee found |
|---|---|
| Malware family | Weedhack |
| Blocked access attempts | More than 6,300 |
| Delivery method | Fake Minecraft client websites |
| Disguise tactics | Copied branding, feature lists, FAQs |
Should you worry?
If someone in your house downloaded a Minecraft client from an unrecognised site recently, treat that computer as compromised until proven otherwise. Run a full antivirus scan. Change passwords for any accounts used on that machine, especially Minecraft, Microsoft and Discord, and do it from a separate device.
Stick to official sources. The Minecraft launcher comes from Microsoft. Mod loaders like Fabric and Forge have official project sites, and reputable modpacks live on platforms such as CurseForge or Modrinth. If a "free" client promises paid features unlocked, that's both the pitch and the payload.
This campaign will keep working as long as search engines rank freshly registered lookalike domains. The postmortem will say, again, that endpoint detection caught the tail end of a problem that started with a Google search.
Operational takeaway: if your users can download and run unsigned executables from any website they like, your malware problem is a policy problem, not a product one.
