{"id":233402,"date":"2026-08-20T05:00:33","date_gmt":"2026-08-20T12:00:33","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=233402"},"modified":"2026-08-19T10:24:39","modified_gmt":"2026-08-19T17:24:39","slug":"weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/","title":{"rendered":"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware"},"content":{"rendered":"

Authored by Aayush Tyagi<\/span><\/span>\u00a0<\/span><\/em><\/p>\n

What McAfee Labs found<\/span><\/b>\u00a0<\/span><\/h2>\n

McAfee Labs\u2019 latest investigation into the WeedHack malware campaign found that the threat has continued to evolve even after its original command-and-control infrastructure was disrupted by McAfee. Researchers identified <\/span>multiple active websites still distributing WeedHack to gamers<\/span><\/b>, often by impersonating legitimate Minecraft clients, offering paid tools for free, or using trusted platforms to make malicious downloads appear credible.<\/span>\u00a0<\/span><\/p>\n

Among the findings:<\/span>\u00a0<\/span><\/p>\n

\u2192 More than 6,300 attempts to access malicious sites were blocked by McAfee WebAdvisor in the past month.<\/span><\/b>\u00a0<\/span><\/p>\n

\u2192 <\/b>Researchers found <\/span>lookalike gaming websites designed to closely replicate legitimate projects<\/span><\/b>, including their branding, feature lists, FAQs, installation guides, developer credits, and links to genuine GitHub repositories.<\/span>\u00a0<\/span><\/p>\n

\u2192 <\/b>In one case, <\/span>the top two Google results observed by researchers for a popular Minecraft client led to sites distributing WeedHack<\/span><\/b>, demonstrating how SEO poisoning can put malicious downloads directly in gamers\u2019 paths.<\/span>\u00a0<\/span><\/p>\n

\u2192 <\/b>Nearly <\/span>half of the malicious URLs identified were Discord links (49.6%)<\/span><\/b>, followed by MediaFire (23.4%) and GitHub (8.2%), showing how attackers can use familiar platforms alongside fake websites to distribute malware.<\/span>\u00a0<\/span><\/p>\n

\u2192 <\/b>Researchers also identified a malicious site built using an <\/span>AI-powered website creation platform<\/span><\/b>, illustrating how readily available tools can make it easier to launch convincing new malicious sites.<\/span>\u00a0<\/span><\/p>\n

Threats like these show why protection needs to start before a malicious download ever reaches your device. <\/span>McAfee helps block dangerous websites and downloads before malware has a chance to install, helping you stay focused on the game.<\/span><\/b>\u00a0<\/span><\/p>\n

Threats like <\/span>these show<\/span> why protection needs to start before a malicious download ever reaches your device. <\/span><\/span>McAfee helps block dangerous websites and downloads before malware has a chance to install<\/span>,<\/span> helping <\/span>you <\/span>stay focused on the game<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

Background<\/span>\u00a0<\/span><\/h2>\n

2026 has seen a significant shift in malware tactics, where traditional perimeter breaching techniques are being traded in for more elusive methods, such as AI-powered phishing and widespread deployment of Info-stealer malware. Over 560,000 new malware variants are detected every day, with infostealers accounting for the most active category.<\/span><\/p>\n

McAfee Labs has also seen a significant spike in Malware-as-a-service (MaaS) campaigns, that offer their customers access to sophisticated infostealers and backdoor malware samples at minimal cost. These campaigns provide detailed tutorials to their customers, teaching them how to target popular gaming software, develop authentic-looking websites, and implement SEO Poisoning techniques in order to bamboozle gamers and infect their systems.<\/span>\u00a0<\/span><\/p>\n

Introduction<\/span>\u00a0<\/span><\/h2>\n

Recently, McAfee Labs has covered a Malware-as-a-service campaign, called \u2018Weedhack\u2019 that infected over 116,464 gamers and utilized SEO Poisoning techniques to infect such a large user base. <\/span><\/p>\n

Read the original article here: <\/span>Game Over: WeedHack \u2013 The Rise of Minecraft Malware-as-a-Service Campaigns<\/span><\/a><\/p>\n

While uncovering the depths of this campaign, <\/span>we\u2019ve encountered multiple websites and file hosting services that are still active and distributing WeedHack malware<\/span><\/b>. In this article, we cover some of the most prominent examples we\u2019ve encountered in the wild to educate our readers and provide key insights on how to identify and avoid such malicious websites.\u00a0<\/span>\u00a0<\/span><\/p>\n

Note: This list is not exhaustive, and there may be additional websites that are not covered in this article.<\/span><\/b><\/p>\n

Malicious websites spreading WeedHack<\/span>\u00a0<\/span><\/h2>\n

During our investigation of this campaign, we observed that most of these websites appear legitimate, as they are well-crafted and often mimic legitimate websites. We observed a series of dedicated brand-impersonation attacks targeting several popular Minecraft clients.<\/span>\u00a0<\/span><\/p>\n

We published the original article in the first week of July, and, as a result, we\u2019ve seen a disruption in WeedHack\u2019s campaign: its C2 server is no longer active. Consequently, we have observed a shift in tactics by these attackers.\u00a0<\/span>\u00a0<\/span><\/p>\n

The WeedHack Dashboard has been taken down, yet we\u2019ve discovered <\/span>websites that are actively spreading WeedHack malware.<\/span><\/b>\u00a0<\/span>\u00a0<\/span><\/p>\n

Out of these URLs, most belonged to file-hosting services:\u00a0<\/span>\u00a0<\/span><\/p>\n

    \n
  • 49.6% were Discord links<\/span>\u00a0<\/span><\/li>\n
  • 23.4% were MediaFire links,<\/span>\u00a0<\/span><\/li>\n
  • 8.2% were GitHub links<\/span>\u00a0<\/span><\/li>\n
  • 4.6% were Dropbox links<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

    The remaining URLs were customer-facing websites designed to deceive users.<\/span>\u00a0<\/span><\/p>\n

    In the last month, <\/span>McAfee WebAdvisor has prevented more than 6,300 users from accessing these malicious websites.<\/span><\/b> At the time of writing this blog, the following websites were still distributing WeedHack malware.\u00a0<\/span>\u00a0<\/span><\/p>\n

    \n
    \"Figure
    Figure 1: glazed-client landing page<\/em><\/figcaption><\/figure>\n<\/div>\n

     <\/p>\n

    This website <\/span>\u2018<\/span>glazed-client.com<\/span>\u2019 replicates the <\/span>original website called \u2018<\/span>glazedclient.com<\/span>\u2019<\/span>.<\/span> It provides <\/span>a free <\/span>and <\/span>open-source <\/span>Minecraft <\/span>add-on <\/span>called <\/span>\u2018<\/span>Glazed Client<\/span>\u2019 <\/span>designed specifically for <\/span>DonutSMP<\/span> server. <\/span><\/span>\u00a0<\/span>
    <\/span>\u00a0<\/span>
    <\/span>The website <\/span>contains<\/span> a feature list, along with Archive, Credits, and FAQ sections,<\/span> that are <\/span><\/strong><\/span>identical to those on the original website<\/span><\/span>.<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n

    \"Figure
    Figure 2: Feature list<\/em><\/figcaption><\/figure>\n

    Under the download<\/span> section, <\/span>the website<\/span> provides<\/span> three download <\/span>options,<\/span> and <\/span><\/span>all of them are infected <\/span>with <\/span>W<\/span>eed<\/span>H<\/span>ack<\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/strong><\/em><\/p>\n

    \"Figure
    Figure 3: Download Section<\/em><\/figcaption><\/figure>\n

    This website ha<\/span>s<\/span> a <\/span>GitHub<\/span> link, which <\/span>links<\/span> to <\/span>a<\/span> legitimate GitHub repository<\/span> in order to<\/span> build trust with the visitors.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    Example <\/span>2<\/span> \u2013 radium-client.com<\/span><\/span>\u00a0<\/span><\/h2>\n
    \"Figure
    Figure 4: radium-client landing page<\/em><\/figcaption><\/figure>\n

     <\/p>\n

    The website <\/span>\u2018<\/span>radium-client.com\u2019 is replicating a legitimate <\/span>website called \u2018radiumclient.com<\/span>\u2019<\/span>.<\/span> The original website <\/span>offers Minecraft <\/span>client<\/span> for $9.99<\/span> per month, but the malicious <\/span>website<\/span> offers the same tool for free. <\/span><\/span>\u00a0<\/span>
    <\/span><\/p>\n

    Th<\/span>e malicious replica <\/span>also has a detailed<\/span> feature<\/span> and download section.<\/span><\/span> The<\/span> downloaded JAR<\/span> file is <\/span>infected with <\/span>W<\/span>eed<\/span>H<\/span>ack<\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n

    \"Figure
    Figure 5: feature list and download button<\/em><\/figcaption><\/figure>\n

    In this instance, the <\/span>malicious <\/span>website <\/span>contains<\/span> a discord link<\/span>, <\/span>similar to<\/span> the original website, but <\/span>it points<\/span> to a channel called \u2018<\/span>EasyClients<\/span>\u2019<\/span>,<\/span> that has over <\/span>1,900 members.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 6: EasyClients Discord Channel<\/em><\/figcaption><\/figure>\n

    This <\/span>channel<\/span> offers <\/span>7 different<\/span> DonutSMP<\/span> clients <\/span>for free (Image 7, <\/span>H<\/span>ighlighted in <\/span>R<\/span>ed) <\/span><\/span>which are a<\/span>lso infected with <\/span>WeedHack<\/span><\/strong><\/em>.<\/span><\/span>\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 7: EasyClients Discord Channel<\/em><\/figcaption><\/figure>\n

    Example 3 <\/span>\u2013 seedcrackerx.github.io<\/span><\/span>\u00a0<\/span><\/h2>\n
    \"Figure
    Figure 8: SeedCrackerX\u2019s landing page<\/em><\/figcaption><\/figure>\n

    In this example, we see GitHub\u2019s web hosting service<\/span> \u2018GitHub.io\u2019 being exploited by attackers<\/span>. H<\/span>ere they are <\/span>impersonating \u2018<\/span>SeedCrackerX<\/span>\u2019 <\/span>tool<\/span>, <\/span>which is a <\/span>Minecraft seed cracking<\/span> software capable of <\/span>identifying<\/span> the <\/span>exact world seed <\/span>used to generate a<\/span> Minecraft<\/span> world.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 9: FAQ section<\/em><\/figcaption><\/figure>\n

    Here, <\/span><\/span>the malicious websites imitate the original website \u2018<\/span>seedcrackerx.com<\/span>\u2019,<\/span><\/strong> by replicating its fonts and color palette<\/strong>.<\/span><\/span> The website also includes an elaborate tutorial and FAQ section<\/span>, educating the visitors on how to <\/span>properly install<\/span> the tool.<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 10: Download section<\/em><\/figcaption><\/figure>\n

    Under the download section, the website offers seven versions to choose from, but <\/span>all of them are infected with WeedHack. <\/span><\/i><\/b>(Highlighted in Red)<\/span>\u00a0<\/span><\/p>\n

    This malicious website has also linked the genuine GitHub repository hosting the SeedCrackerX tool (Highlighted in Green), to appear more legitimate.\u00a0<\/span>\u00a0<\/span><\/p>\n

    Example 4 \u2013 xenoclient.lol and xenonclient.com<\/span>\u00a0<\/span><\/h2>\n

    Xenon Client is one of the most popular Minecraft Clients, known for being lightweight, community driven and offering niche vanilla-friendly utilities. Given its widespread popularity, this client is a prominent target for threat actors.<\/span><\/p>\n

    \"Figure
    Figure 11: Google search results for \u2018Xenon Client\u2019<\/em><\/figcaption><\/figure>\n

     <\/p>\n

    During our research, we <\/span>identified<\/span> that <\/span><\/span>the top two Google search results for <\/span>\u2018<\/span>Xenon Client<\/span>\u2019<\/span><\/span> directed users to website<\/span>s <\/span>(Highlighted in Red) <\/span>that <\/span><\/span>are spreading <\/em><\/span><\/span><\/span>Weed<\/span><\/span><\/span>H<\/span><\/span>ack<\/span><\/span><\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/em><\/strong><\/p>\n

    \"Figure
    Figure 12: Xenoclient.lol Landing Page<\/em><\/figcaption><\/figure>\n

    The “<\/span>xenoclient.lol<\/span>” website is particularly noteworthy, <\/span>for the range of features and support <\/span>it offer<\/span>s. <\/span><\/span>The website includes comprehensive download and installation guides, as well as FAQ and Credits sections<\/span>.<\/span><\/span><\/strong> Additionally, it lists the original Xenon Client GitHub repository<\/span> and features a community section for like-minded <\/span>gamers, further enhancing its professional appearance.<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 13: Xenoclient.lol Purchase Options<\/em><\/figcaption><\/figure>\n

    It offers 2 purchase <\/span>options for<\/span> free and premium, where the premium version is listed for $5.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 14: Download Page<\/em><\/figcaption><\/figure>\n

    The free option, on the other hand, offers six download options for the main client and six additional options for the client optimizer. At the time of writing, only one download link remains operational (highlighted in red), and it delivers a payload infected with WeedHack.<\/span>\u00a0<\/span><\/p>\n

    Another website, “xenonclient.com,” is also targeting Minecraft players, luring them with a free version of the same client.<\/span><\/b>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 15: xenonclient.com Landing Page<\/em><\/figcaption><\/figure>\n

    Similar to other websites in the campaign, this site includes an installation guide and a feature list for the Xenon Client to enhance its apparent legitimacy.<\/span><\/span>\u00a0<\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 16: Feature List<\/em><\/figcaption><\/figure>\n

    The final <\/span>JAR file<\/span> downloaded from this website infects users with <\/span>WeedHack<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

    Example <\/span>5<\/span> \u2013 nova-client.com<\/span><\/span>\u00a0<\/span><\/h2>\n

    Nova client is a<\/span>n<\/span> open-source client designed for Minecraft Bedrock Edition. <\/span><\/span><\/p>\n

    \"Figure
    Figure 17: Nova-Client\u2019s landing page<\/em><\/figcaption><\/figure>\n

     <\/p>\n

    This client is an easy target for attackers<\/span> because it lacks an official website<\/span>.<\/span> The l<\/span>egitimate <\/span>client is hosted on GitHub and <\/span>Modrinth<\/span>; however<\/span><\/span>, attacker<\/strong><\/span>s ha<\/span>ve created a spoofed website <\/span>and <\/span>leveraged<\/span> SEO poisoning techniques<\/span><\/strong><\/span> to outrank the official sources<\/span> in search results.<\/span>\u00a0<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n

    \"Figure
    Figure 18: Feature Section<\/em><\/figcaption><\/figure>\n

    This website also includes a Features page, installation guide, and FAQ section. In addition, <\/span>it displays<\/span> screenshots from the legitimate Nova Client to deceive users.<\/span><\/span>\u00a0<\/span>
    <\/span>\u00a0<\/span>
    <\/span>W<\/span>hat is interesting here <\/span>is<\/span> that a<\/span>ttackers <\/span>have<\/span> also included a credits <\/span>section,<\/span> which is common with legitimate Minecraft client websites<\/span>.<\/span> However, they do not mention anyone who has actually worked on the project and instead use<\/span>d <\/span>generic team names.<\/span>\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 19: Credits Section<\/em><\/figcaption><\/figure>\n

    The download section provides <\/span>No<\/span>va Clien<\/span>t for Minecraft 1.21.11, but <\/span><\/span>the download file spreads WeedHack<\/strong><\/em><\/span> malware.<\/span><\/strong><\/em><\/span>\u00a0<\/span><\/strong><\/em><\/p>\n

    \"Figure
    Figure 20: Download Section<\/em><\/figcaption><\/figure>\n

    Example <\/span>6<\/span> \u2013\u00a0 <\/span>cheatlib.xyz<\/span><\/span>\u00a0<\/span><\/h2>\n

    Cheat<\/span>Lib<\/span> advertises <\/span>that <\/span>their <\/span>clients<\/span> have been downloaded over 1.6<\/span> million <\/span>times,<\/span> are free from malware<\/span> and <\/span>offers round-the-clock support.<\/span><\/span><\/p>\n

    \"Figure
    Figure 21: CheatLib\u2019s landing page<\/em><\/figcaption><\/figure>\n

    \u00a0Similar to other such websites, it also features a setup guide and a FAQ section to address common user issues.<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 22: Status Section<\/em><\/figcaption><\/figure>\n

    They provide eight Minecraft Mods and <\/span>inform users which Minecraft servers<\/span> and anti-cheat systems<\/span> they can bypass,<\/span> as well as the <\/span>current<\/span> status<\/span> of each mod.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 23: Download Section<\/em><\/figcaption><\/figure>\n

    Although the website offers eight distinct mods, <\/span><\/span>all eight files share the same hash and distribute the <\/span>WeedHack<\/span> payload.<\/span><\/span>\u00a0<\/span><\/strong><\/em><\/p>\n

    \"Figure
    Figure 24: CheatLib Discord Channel<\/em><\/figcaption><\/figure>\n

    This website also <\/span>links to<\/span> a Discord channel<\/span> called \u2018<\/span>CheatLib<\/span>\u2019 with over 220 users, which also provides access to <\/span>WeedHack<\/span> infected <\/span>mods<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

    Example <\/span>7 <\/span>\u2013 meteorclients.com<\/span><\/span>\u00a0<\/span><\/h2>\n
    \"Figure
    Figure 25: Meteor Client\u2019s landing page<\/em><\/figcaption><\/figure>\n

    This malicious domain \u2018meteorclients.com\u2019<\/span> is <\/span>impersonating a legitimate website \u2018<\/span>meteorclient.com<\/span>\u2019.<\/span> <\/span>Th<\/span>e<\/span>y <\/span>claim that this client has been downloaded over 10 million times and <\/span>has over 15 thousand active users at any given time.\u00a0<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n

    \"Figure
    Figure 26: Team Section<\/em><\/figcaption><\/figure>\n

    The Team section <\/span>contains<\/span> the names of the legitimate Meteor Client developers, which appear to have been copied from the project’s official website<\/span>,<\/span> to create an appearance of authenticity.<\/span>\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 27: Preview Section<\/em><\/figcaption><\/figure>\n

    They also provide an interactive preview of <\/span>Meteor <\/span>client on the website<\/span>,<\/span> enabling users to test and familiarize themselves with the client<\/span>.<\/span><\/span> The website offers a single download <\/span>option<\/span>, which is infected with <\/span>WeedHack<\/span>.<\/span><\/span>\u00a0<\/span><\/strong><\/em><\/p>\n

    Example <\/span>8<\/span> \u2013 22qq-client.com<\/span><\/span>\u00a0<\/span><\/h2>\n

    22qq-client is a <\/span>Minecraft Mod for <\/span>Crystal PVP servers.<\/span><\/p>\n

    \"Figure
    Figure 28: 22qq-client\u2019s Landing Page<\/em><\/figcaption><\/figure>\n

    This mod does not have a dedicated <\/span>website,<\/span> and attackers are <\/span>exploiting this <\/span>issue<\/span>. <\/span>This website<\/span> is meant to<\/span> serve<\/span> as the official page for the client.<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 29: FAQ section.<\/em><\/figcaption><\/figure>\n

    The attackers <\/span>attempt<\/span> to establish credibility by using screenshots from the legitimate client<\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 30: Preview of 22-qq.<\/em><\/figcaption><\/figure>\n

    They also offer an interactive <\/span>preview of the client to give users an overview of its functionality. <\/span>This website provides <\/span>multiple download buttons<\/span>,<\/span> but <\/span><\/span>all of them download the same JAR file,<\/span> which i<\/span>s infected with WeedHack.<\/span><\/span>\u00a0<\/span><\/strong><\/em><\/p>\n

    Example <\/span>9<\/span> \u2013 <\/span>kryptonclientcrack.lovable.app<\/span><\/span>\u00a0<\/span><\/h2>\n

    Krypton Client is a paid Minecraft <\/span>tool for <\/span>DonutSMP<\/span> server, hosted on \u2018kryptonclient.org<\/span>\u2019.<\/span> This malicious counterpart claims to offer a cracked version of the tool.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 31: Krypton\u2019s Landing Page<\/em><\/figcaption><\/figure>\n

    The attackers have used <\/span>an AI-powered <\/span>tool called \u2018<\/span>lovable.app<\/span>\u2019 <\/span>that <\/span>allows<\/span> customers to build and launch functional web applications and websites<\/span>, using natural language. <\/span>Such <\/span>tools<\/span> make<\/span> it easier for attackers to deploy new malicious domains on the fly.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 32: Download Section<\/em><\/figcaption><\/figure>\n

    The website claims that the tool has been downloaded more than five thousand times and has been thoroughly tested for safety. <\/span><\/span>They offer a single download <\/span>option<\/span>, which is infected with <\/span>WeedHack<\/span>.<\/span><\/span>\u00a0<\/span><\/strong><\/em><\/p>\n

    Example 10 \u2013 File Hosting Services\u00a0<\/span>\u00a0<\/span><\/h2>\n

    In the course of our investigation, we observed that multiple attackers were exploiting various file hosting services to spread malware.<\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 33: GitHub Repository spreading WeedHack<\/em><\/figcaption><\/figure>\n

    Links to these <\/span>websites are then distributed via <\/span>different communication channels, such as Discord, <\/span>Reddit<\/span> and other online platforms.<\/span><\/span>\u00a0<\/span><\/p>\n

    \"Figure
    Figure 34: GitHub Repository spreading WeedHack<\/em><\/figcaption><\/figure>\n

    We also <\/span>observed<\/span> that<\/span><\/span> threat actors extended their targeting beyond Minecraft clients<\/strong>,<\/span><\/span> compromising various popular and independent community <\/span>websites<\/span> within the Minecraft ecosystem.<\/span><\/span><\/p>\n

    \"Figure
    Figure 35: Planet Minecraft<\/em><\/figcaption><\/figure>\n

    At the time of this analysis, the following Planet Minecart links were spreading WeedHack malware.<\/span>\u00a0<\/span><\/p>\n

    hxxps:\/\/static.planetminecraft.com\/files\/resource_media\/mod\/mousetweaks-fabric-mc1-21-9-2-29.jar<\/span><\/b>\u00a0<\/span><\/p>\n

    hxxps:\/\/static.planetminecraft.com\/files\/resource_media\/mod\/no-delay-optimizer1-21-4.jar<\/span><\/b>\u00a0<\/span><\/p>\n

    Similarly, we observed another community website, called EndMods was also targeted by WeedHack.<\/span><\/p>\n

    \"Figure
    Figure 36: EndMods<\/em><\/figcaption><\/figure>\n

    The following link <\/span>is still active, at the time of <\/span>publication<\/span>, and is still spreading the <\/span>WeedHack<\/span> malware. <\/span><\/span>\u00a0<\/span>
    <\/span>hxxps:\/\/endmods.com\/wp-content\/uploads\/2026\/02\/KRYPTON-CLIENT1.0.zip<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n

    How To Protect Yourself Online<\/span>\u00a0<\/span><\/h2>\n

    At McAfee Labs, we investigate threats across the digital landscape, and gamers are a frequent target. We\u2019ve seen multiple malware-as-a-service campaigns similar to WeedHack use fake downloads, impersonated websites, malicious mods, and other lures to target gaming communities.<\/span>\u00a0<\/span><\/p>\n

    AI-powered tools can make it faster and easier for scammers to create convincing websites, imitate legitimate services, and launch new campaigns at scale. That makes it even more important to know what you\u2019re downloading, and where it\u2019s coming from.<\/span>\u00a0<\/span><\/p>\n

    Here are a few ways gamers can stay safer:<\/span><\/b>\u00a0<\/span><\/p>\n

    \u2192 Stick to trusted sources.<\/span><\/b> Download games, mods, clients, and other files from official developer websites or reputable mod platforms whenever possible. If you can\u2019t verify the source, don\u2019t download it.<\/span>\u00a0<\/span><\/p>\n

    \u2192 Never turn off your security software for a download.<\/span><\/b> Be suspicious of any mod, cheat, or client that tells you to disable your antivirus or other protections before installing it.<\/span>\u00a0<\/span><\/p>\n

    \u2192 Scan files before opening them.<\/span><\/b> Check downloaded mods, installers, and archives before running them \u2014 even if they came from a popular gaming community or website.<\/span>\u00a0<\/span><\/p>\n

    \u2192 Be skeptical of offers that seem too good to be true.<\/span><\/b> \u201cFree\u201d premium features, exclusive cheats, cracked software, or paid clients can be used as bait to convince gamers to download malware.<\/span>\u00a0<\/span><\/p>\n

    \u2192 Check the URL before you download.<\/span><\/b> Scammers can create lookalike domains and convincing copies of legitimate gaming sites. Small changes in a web address can be a sign you\u2019re on an impersonation site.<\/span>\u00a0<\/span><\/p>\n

    \u2192 Pay attention to security warnings.<\/span><\/b> If your antivirus flags a download, don\u2019t automatically assume it\u2019s a false positive. Stop and investigate before allowing the file to run.<\/span>\u00a0<\/span><\/p>\n

    \u2192 Keep your devices and software updated.<\/span><\/b> Install updates for your operating system, browser, games, and security software to help protect against known vulnerabilities.<\/span>\u00a0<\/span><\/p>\n

    Indicator of Compromise(s)\u202f<\/span><\/span>\u00a0<\/span><\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    hxxps:\/\/glazed-client.com\/<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/github.com\/Hl3n\/GambleRigMod<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/www.radium-client.com\/<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/discord.com\/channels\/1467145812906872834\/<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/seedcrackerx.github.io\/<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/github.com\/seedcrackerx\/seedcrackerx.github.io<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/xenonclient.com\/<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/xenoclient.lol\u00a0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/nova-client.com\/<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/cheatlib.xyz\/<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/discord.com\/channels\/1478170973755936990<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/meteorclients.com<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxp:\/\/22qq-client.com\/<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/kryptonclientcrack.lovable.app<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/github.com\/lsellh\/<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/static.planetminecraft.com\/files\/resource_media\/mod\/mousetweaks-fabric-mc1-21-9-2-29.jar<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/static.planetminecraft.com\/files\/resource_media\/mod\/no-delay-optimizer1-21-4.jar<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    hxxps:\/\/endmods.com\/wp-content\/uploads\/2026\/02\/KRYPTON-CLIENT1.0.zip<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    Authored by Aayush Tyagi\u00a0 What McAfee Labs found\u00a0 McAfee Labs\u2019 latest investigation into the WeedHack malware campaign found that the…<\/p>\n","protected":false},"author":695,"featured_media":230210,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[10667,10661,13,1838,8050,12,442],"tags":[],"coauthors":[4136],"class_list":["post-233402","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-news","category-internet-security","category-privacy-identity-protection","category-mobile-security","category-mcafee-news","category-family-safety","category-mcafee-labs"],"acf":[],"yoast_head":"\nWeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware | McAfee Blog<\/title>\n<meta name=\"description\" content=\"McAfee Labs found active websites still spreading WeedHack malware to gamers, using fake Minecraft clients, lookalike sites, SEO poisoning, and trusted platforms to lure victims.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"McAfee Labs found active websites still spreading WeedHack malware to gamers, using fake Minecraft clients, lookalike sites, SEO poisoning, and trusted platforms to lure victims.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-20T12:00:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"712\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware\",\"datePublished\":\"2026-08-20T12:00:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/\"},\"wordCount\":2730,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg\",\"articleSection\":[\"Security News\",\"Internet Security\",\"Privacy & Identity Protection\",\"Mobile Security\",\"McAfee News\",\"Family Safety\",\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/\",\"name\":\"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg\",\"datePublished\":\"2026-08-20T12:00:33+00:00\",\"description\":\"McAfee Labs found active websites still spreading WeedHack malware to gamers, using fake Minecraft clients, lookalike sites, SEO poisoning, and trusted platforms to lure victims.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg\",\"width\":712,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware | McAfee Blog","description":"McAfee Labs found active websites still spreading WeedHack malware to gamers, using fake Minecraft clients, lookalike sites, SEO poisoning, and trusted platforms to lure victims.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware | McAfee Blog","og_description":"McAfee Labs found active websites still spreading WeedHack malware to gamers, using fake Minecraft clients, lookalike sites, SEO poisoning, and trusted platforms to lure victims.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2026-08-20T12:00:33+00:00","og_image":[{"width":712,"height":600,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg","type":"image\/jpeg"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware","datePublished":"2026-08-20T12:00:33+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/"},"wordCount":2730,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg","articleSection":["Security News","Internet Security","Privacy & Identity Protection","Mobile Security","McAfee News","Family Safety","McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/","name":"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg","datePublished":"2026-08-20T12:00:33+00:00","description":"McAfee Labs found active websites still spreading WeedHack malware to gamers, using fake Minecraft clients, lookalike sites, SEO poisoning, and trusted platforms to lure victims.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2026\/05\/Gaming_Thumbnail.jpeg","width":712,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/weedhack-minecraft-malware-fake-gaming-websites-seo-poisoning\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/233402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=233402"}],"version-history":[{"count":7,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/233402\/revisions"}],"predecessor-version":[{"id":233949,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/233402\/revisions\/233949"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/230210"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=233402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=233402"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=233402"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=233402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}