Cybercriminals are distributing WeedHack malware through fake Minecraft mods to steal user data and gain remote access to computers [1], [2].

This campaign is significant because it leverages a "malware-as-a-service" model, making sophisticated hacking tools accessible to low-skill attackers for a nominal fee. By targeting a popular game with a large youth demographic, the attackers increase the likelihood of successful infections via trusted-looking community content.

The malware is disguised as game modifications and is distributed through fake download sites and YouTube videos [2], [5]. Once installed, WeedHack allows attackers to steal account credentials, social-media logins, and cryptocurrency wallet information [1], [3], [4]. The software also grants attackers the ability to access the victim's webcam [4].

Reports said that approximately 116,000 Minecraft players have been infected [2], [3], [5]. The scale of the operation is supported by its affordability; the WeedHack service is offered to aspiring attackers for as little as $5 [1].

Beyond financial and data theft, some victims said they were subjected to cyber-bullying after their systems were compromised [1], [6]. The attackers use the gained access to monitor users and manipulate their online presence.

Security researchers said the distribution network relies heavily on social engineering—specifically using the promise of game enhancements to trick users into bypassing security warnings. Because the malware targets a gaming community, it often bypasses standard corporate security scrutiny while infiltrating home networks.

“WeedHack is offered to aspiring attackers for as little as $5.”

The rise of WeedHack illustrates the commodification of cybercrime, where the 'as-a-service' model lowers the barrier to entry for attackers. By targeting the gaming community, criminals can exploit the trust and technical curiosity of younger users who may be less likely to employ rigorous security protocols. This shift transforms high-level threats like webcam spying and credential theft from specialized attacks into cheap, scalable products.