A malware-as-a-service operation dubbed WeedHack by McAfee researchers infected 116,464 Minecraft players between January and June 2026, gaining webcam access and stealing data. The operation ran at 2,000 to 3,000 new victims per day and was sold for as little as $5, compared to the $250-to-$500 monthly cost of comparable dark-web toolkits. It spread through fake YouTube tutorials and SEO-poisoned download sites targeting popular Minecraft clients including Meteor, LiquidBounce, and Wurst. Once installed, the malware connected to a command server hidden inside the Ethereum blockchain to resist takedowns, disabled Windows Defender, and embedded itself silently. McAfee published its findings on June 2.
McAfee researchers found a malware operation called WeedHack that hit 116,464 minecraft players since january, running 2,000 to 3,000 new infections a day. it sold for $5 through a discord server — no dark web needed, no $250-a-month subscription. it spread through fake youtube tutorials and SEO-gamed download sites targeting popular mod clients like meteor, liquidbounce, and wurst. once on your machine it killed windows defender, hid its command server inside the ethereum blockchain, and quietly watched through webcams. the whole thing had a free tier, a leaderboard, and a suggestion box. mcafee went public with the research on june 2.
Fills a coverage gap in underrepresented tech category (4%) with specific, checkable cybersec claims (infection numbers, pricing, blockchain C2) sourced from McAfee research via Dexerto; the $5 Discord storefront detail and Ethereum C2 technique add genuine internet-culture novelty beyond generic malware recaps.
The WeedHack operation exposes a rapidly maturing malware-as-a-service economy built around gaming communities, where low price points and Discord distribution dramatically lower the barrier to entry for would-be attackers. Minecraft's younger player base makes webcam access especially concerning, and the use of Ethereum blockchain infrastructure to resist takedowns signals an evolving cat-and-mouse game between malware developers and security researchers. This is the latest in a pattern of fake-mod campaigns targeting Minecraft's enormous modding ecosystem.
a $5 malware toolkit with a discord storefront and a leaderboard. the barrier to entry for mass surveillance just cratered. minecraft skews young — 116K kids with compromised webcams is not a hypothetical. the ethereum blockchain trick for dodging takedowns is new and it'll show up in the next one too. mod malware campaigns targeting minecraft aren't slowing down.
Public story text does not change until an admin approves it.
Looped stories are not disposable posts: receipts, claims, reader checks, and moderator decisions can change the approved version over time.