WeedHack

Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown

Malicious websites impersonating Minecraft clients, mods, and related tools are continuing to distribute the WeedHack malware family despite prior command-and-control disruption. McAfee Labs identified at least 10 active sites and multiple file-hosting accounts tied to the campaign, while McAfee WebAdvisor blocked more than 6,300 attempts to reach them in the past month. The lures are amplified through SEO poisoning, YouTube links, Discord, GitHub repositories, and trusted Minecraft community platforms, with attackers using convincing lookalike pages to trick gamers into downloading malicious files. The infection chain delivers Java JAR payloads that collect system information, add Microsoft Defender exclusions, and steal credentials, browser data, cookies, and cryptocurrency wallets from infected hosts. Earlier reporting linked the Malware-as-a-Service operation to at least 116,464 infected systems and 2,000 to 3,000 new victims per day, while researchers said the operators used EtherHiding to retrieve active server addresses from the Ethereum blockchain and keep the campaign resilient after takedowns. One spoofed site was reportedly built with the AI website builder Lovable, underscoring how easily attackers can create realistic malware-delivery infrastructure.

Top Google Results for Minecraft Client Led Gamers to Malware, McAfee Finds

Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

Evolution of JSWorm ransomware | Securelist

Nefilim emerged as a distinct ransomware operation built from Nemty 2.5 code, abandoning the earlier ransomware-as-a-service model in favor of private, targeted intrusions and email-based ransom negotiations. The malware encrypts files with AES-128 and protects keys with RSA-2048, appends the .NEFILIM extension, and drops NEFILIM-DECRYPT.txt, while also stealing data and threatening to publish it if victims do not pay. Researchers linked Nefilim to the broader JSWorm/Nemty/Nefilim lineage through shared cryptographic logic, ransom-note patterns, and infrastructure, showing a progression from mass distribution via the RIG exploit kit, spam, and the Trik/Phorpiex botnet to enterprise-focused attacks.

Nefilim Ransomware: Tactics, Impact, and Mitigation Strategies | Qualys

An Analysis of the Nefilim Ransomware | Trend Micro (US)

Home appliance giant Whirlpool hit in Nefilim ransomware attack

Nemty Ransomware - Learning by Doing | McAfee Blog