{"id":230144,"date":"2026-06-02T05:00:12","date_gmt":"2026-06-02T12:00:12","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=230144"},"modified":"2026-05-29T13:50:32","modified_gmt":"2026-05-29T20:50:32","slug":"minecraft-malware-campaign-research-teen-hacker-cyberbullying","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/security-news\/minecraft-malware-campaign-research-teen-hacker-cyberbullying\/","title":{"rendered":"New Malware Targeting Minecraft Infects 2K Daily, and Teens are Becoming Attackers"},"content":{"rendered":"

McAfee Labs has discovered a massive, ongoing\u00a0<\/span>malware campaign called\u00a0<\/span><\/a><\/span>WeedHack<\/span><\/span>\u00a0that disguises itself as free Minecraft mods and game clients to infect players’ computers. Since January 2026, it has logged more than\u00a0<\/span><\/span>116,000 victim infections,<\/span><\/span>\u00a0averaging 2,000 to 3,000 new hits every single day.<\/span><\/span>\u00a0<\/span><\/p>\n

What makes\u00a0WeedHack\u00a0different from most malware is how cheap and easy it is to use.<\/span>\u00a0<\/span><\/p>\n

Typically, a hacker would pay hundreds of dollars per month to access attack tools through underground criminal networks.\u00a0WeedHack\u00a0offers a free version to anyone with a Discord account and an internet connection. A premium upgrade, which includes the ability to secretly watch victims through their own webcam, starts at just\u00a0<\/span>$5 a month<\/span><\/b>.<\/span>\u00a0<\/span><\/p>\n

This low barrier has attracted a younger crowd of would-be attackers, many of them\u00a0appear to be\u00a0teenagers\u00a0or young adults.\u00a0Our researchers were startled to discover teens using these tools\u00a0not just for\u00a0financial theft, but to\u00a0<\/span>harass and bully their peers,<\/span><\/b>\u00a0a pattern\u00a0we’ve\u00a0documented and that makes this campaign especially concerning.<\/span>\u00a0<\/span><\/p>\n

The good news for McAfee users:\u00a0<\/span>Web Protection<\/span><\/a> actively blocks the sites distributing\u00a0WeedHack, and Threat Explainer tells you exactly why a flagged file is\u00a0dangerous, so\u00a0you’re\u00a0never left guessing.<\/span>\u00a0<\/span><\/p>\n

Key Facts\u00a0<\/span>at a Glance<\/span><\/span>\u00a0<\/span><\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
What<\/span><\/b>\u00a0<\/span><\/td>\nDetails<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
Campaign name<\/span><\/b>\u00a0<\/span><\/td>\nWeedHack<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Active since<\/span><\/b>\u00a0<\/span><\/td>\nJanuary 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Total victims logged<\/span><\/b>\u00a0<\/span><\/td>\n116,464+<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
New infections per day<\/span><\/b>\u00a0<\/span><\/td>\n~2,000\u20133,000<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Malicious files discovered<\/span><\/b>\u00a0<\/span><\/td>\n3,820+ unique files<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Malicious download URLs<\/span><\/b>\u00a0<\/span><\/td>\n240+<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Free tier available?<\/span><\/b>\u00a0<\/span><\/td>\nYes.\u00a0Anyone can sign up<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Premium price<\/span><\/b>\u00a0<\/span><\/td>\nStarting at $5\/month; $24.99 lifetime<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Who is being targeted<\/span><\/b>\u00a0<\/span><\/td>\nMinecraft players worldwide<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Most affected country<\/span><\/b>\u00a0<\/span><\/td>\nUnited States, followed by Germany, India, the UK, Italy, and others<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
What attackers can access<\/span><\/b>\u00a0<\/span><\/td>\nOnce installed, it can steal passwords, hijack accounts, and, for paying customers, it can give the attacker live access to the victim’s screen, webcam, and files.<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
The\u00a0financial impact<\/span><\/b>\u00a0<\/span><\/td>\nIt can steal Discord tokens, crypto wallet credentials, Minecraft account credentials. <\/span>\u00a0<\/span><\/p>\n

Hackers will hold your information for ransom, requiring a large payment in exchange for your data.<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Read our research team’s full report here.<\/a><\/p>\n

What Is\u00a0WeedHack?<\/span>\u00a0<\/span><\/h2>\n

WeedHack\u00a0is a\u00a0<\/span>Malware-as-a-Service (MaaS)<\/span><\/b>\u00a0campaign, meaning\u00a0it’s\u00a0a criminal business that sells hacking tools to customers, the same way a legitimate software company sells subscriptions.<\/span>\u00a0<\/span><\/p>\n

The “product” is malware that gets secretly installed on a victim’s computer when they download what they think is a Minecraft mod or client.\u00a0Once installed, it can steal passwords, hijack accounts, and, for paying customers, it can give the attacker live access to the victim’s screen, webcam, and files.<\/span>\u00a0<\/span><\/p>\n

The campaign\u00a0operates\u00a0a polished, professional-looking dashboard hosted openly on the internet (not the dark web). That dashboard lets customers track their victims, download stolen data, and launch remote access features, all from a browser.<\/span>\u00a0<\/span><\/p>\n

\"What
What it looks like to buy a subscription from WeedHack.<\/em><\/figcaption><\/figure>\n

The Cyberbullying Problem<\/span>\u00a0<\/span><\/h2>\n

One of the most disturbing findings from our investigation is how\u00a0WeedHack\u00a0is being used.<\/span>\u00a0<\/span><\/p>\n

While monitoring the campaign’s Telegram channel, which had over<\/strong>\u00a0<\/span>850 members<\/span><\/b>\u00a0during\u00a0the time of\u00a0our\u00a0research, we observed that many customers appear to be teenagers and young adults, and a significant portion are using the remote access tools not for financial gain, but to\u00a0<\/span>harass and intimidate other players<\/span><\/b>.\u00a0<\/span>\u00a0<\/span><\/p>\n

We\u00a0observed\u00a0attackers recording victims through their webcams without consent and sharing those recordings in the Telegram channel as trophies. Others used knowledge of victims’ IP addresses and system access to threaten them.<\/span>\u00a0<\/span><\/p>\n

It’s\u00a0important to note that, at the current time of publishing, the Telegram channel has been taken down, and no replacement channel has appeared.\u00a0McAfee is continuing to\u00a0monitor\u00a0any new channels that may be\u00a0established\u00a0by the threat actors for further communication.<\/span>\u00a0<\/span><\/p>\n

Still, what we\u00a0observed\u00a0is a form of cyberbullying with unusually invasive tools behind it. If you or your child has been contacted by someone online claiming they have hacked your computer,\u00a0have\u00a0your webcam footage, or know your IP address, take it seriously.<\/span>\u00a0<\/span><\/p>\n

What to do if this happens:<\/span><\/b>\u00a0<\/span><\/p>\n