Weedhack MaaS Hijacks Minecraft Players Through YouTube Lures

A malware-as-a-service operation targeting Minecraft players has been active since January 2026, riding YouTube tutorials and modding communities to push fake clients onto victims' machines.

Researchers tracking the campaign have named it Weedhack. The count so far: 3,820 infections tied to lures impersonating legitimate Minecraft clients, mods, and cheat tools.

The distribution model is depressingly familiar. Threat actors publish YouTube videos promising free hacks, performance mods, or cracked clients. Description boxes link to download portals. Users execute the installer expecting a mod loader and instead hand over full system control.

Minecraft remains a soft target for a reason. Its player base skews young, runs unsigned Java mods routinely, and treats sideloading as normal behavior. That's the entire threat model in one sentence.

Weedhack operates on a MaaS footing, meaning the operators rent the tooling to affiliates who handle their own distribution. Expect lure variants to multiply as more affiliates onboard. The 3,820 figure is a snapshot, not a ceiling.

The payload's capabilities reportedly include remote control of infected hosts. For a Minecraft-aged demographic, that translates into harvested gaming credentials, linked email accounts, Discord tokens, and any payment methods saved in browser profiles. Parents sharing devices add another exposure layer.

Jurisdiction and disclosure posture

No regulator filing has surfaced yet. Because the campaign is operator-run rather than tied to a single breached entity, there's no notification obligation under GDPR, the FTC's safeguards rule, or state breach laws — the victims are individuals whose own machines were compromised, not customers of a notifying company. That makes recourse thinner than usual.

Mojang and Microsoft have not published an advisory at time of writing. If they do, it will land at msrc.microsoft.com.

What affected users should do

If you or someone in your household installed a Minecraft client, mod pack, or "hack" downloaded from a YouTube description link since January:

• Assume the host is compromised. Pull it off the network before triaging.
• Rotate passwords for Microsoft, Mojang, Google, Discord, and any email account that was signed in. Do this from a clean device.
• Revoke active sessions and OAuth tokens on those accounts. Re-enroll MFA.
• Check browser-saved payment methods and remove anything stored. Review recent charges on linked cards.
• Reinstall the OS rather than relying on AV cleanup. MaaS payloads commonly drop persistence mechanisms that survive surface scans.

For parents: the conversation worth having isn't "don't download mods." It's "only install from CurseForge or Modrinth, and never from a video description." Those two platforms vet uploads. YouTube comments do not.

The campaign is ongoing. Lure videos are still live.