NewsPublished 3 Jun 2026

Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content

Source Reddit Cybersecurity

Discussion

A malware-as-a-service campaign named Weedhack targets Minecraft users by distributing malicious Java JAR files via SEO poisoning and YouTube videos. The malware steals credentials, system information, and can remotely control infected systems. It is notable for its ease of access, free tier, and appeal to younger users, with infections primarily in the U. S.and several other countries. Additionally, a large CountLoader campaign spreads cryptocurrency clipper malware via cracked software, and a separate campaign distributes cryptocurrency miners through pirated content sites. These campaigns leverage sophisticated persistence and evasion techniques and have been active since early 2026.

r/cybersecurity (opens in a new tab)u/sunychoudhary0 points0 comments

https://thehackernews.com/2026/06/weedhack-attacks-minecraft-users.html

Links cited in the discussion

https://thehackernews.com/2026/06/weedhack-attacks-minecraft-users.html

Impact

The Weedhack malware compromises Minecraft users by stealing account credentials, browser data, cryptocurrency wallets, and system information, and enables remote access features that can be abused for harassment and cyberbullying. CountLoader infections have compromised approximately 86,000 machines, spreading cryptocurrency clipper malware that hijacks clipboard transactions. The cryptocurrency miner campaign prolongs device compromise by disabling security tools and power-saving features to maximize mining duration. These combined threats result in credential theft, financial fraud risk, privacy invasion, and potential system control by attackers.

Defensive guidance

Users should avoid downloading Minecraft clients, mods, or software from untrusted sources, especially links found via SEO-poisoned YouTube videos or pirated content sites. Employ endpoint protection solutions capable of detecting Java-based malware and monitor for suspicious network activity. Users should be cautious of unsolicited software updates and verify the authenticity of video player plugins. Since these campaigns rely on social engineering and malicious downloads, user education on safe downloading practices is critical. No official fixes or patches are indicated in the provided data.

Summary

The Weedhack campaign uses SEO poisoning and YouTube videos to distribute malicious Minecraft clients and mods, infecting users with malware capable of stealing Minecraft session IDs, credentials, browser data, and cryptocurrency wallets. The malware employs Ethereum blockchain-based EtherHiding for C2 communication and includes multiple Java payloads for persistence and remote access. The service offers free and premium tiers with escalating capabilities, including webcam access and keylogging. The campaign is supported by a Telegram channel with over 850 members. Concurrently, CountLoader malware spreads via cracked software and USB drives, delivering payloads such as cryptocurrency clippers. Another campaign distributes cryptocurrency miners disguised as fake video player updates on pirated streaming sites, using DLL side-loading and persistence mechanisms. These campaigns have been observed globally, with notable infection clusters in the U.S., India, Germany, and Southeast Asia.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 3 Jun 2026, 07:48 UTC

Technical details

References

Community reviews