Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown
Brief
WeedHack Minecraft Malware Survives C2 Takedown: Fake Client Sites Still Active, SEO Poisoning Puts Malicious Downloads at the Top of Google
McAfee Labs published a follow-up report on the WeedHack Malware-as-a-Service campaign this week, documenting ten active malicious sites and multiple file-hosting accounts that are still spreading the infostealer despite a disruption to its command-and-control infrastructure. Over the past month alone, McAfee WebAdvisor blocked more than 6,300 user attempts to reach these sites.
WeedHack was first spotted in early June 2026 when McAfee researcher Aayush Tyagi documented a Malware-as-a-Service operation that had been running since January and had logged 116,464 infected systems, adding between 2,000 and 3,000 new victims every day.