A Malware‑as‑Service operation dubbed WeedHack has compromised more than 116,000 Minecraft users since January 2026, turning a seemingly harmless game mod into a potent surveillance and data‑theft tool.
WeedHack sold as a Discord‑based subscription service
Cybersecurity analysts at McAfee identified the threat as a subscription model that requires only a Discord account and an internet connection. For as little as $5 a month, attackers unlock a premium suite that grants remote desktop control, credential harvesting and webcam access without needing expensive hacking infrastructure.
Deceptive promotion drives unsuspecting downloads
The counterfeit mod is marketed as a performance enhancer or a new game client, often promoted through polished YouTube tutorials and manipulated search‑engine results that push malicious links above legitimate sources. Once installed, the payload runs silently, siphoning passwords, cookies, Discord login data, cryptocurrency wallet details, and Minecraft IDs, while in extreme cases streaming the victim’s screen and webcam to the cyber‑criminal.
Low cost fuels teen‑driven harassment campaigns
Investigations revealed that many operators are teenagers or young adults seeking to bully peers. The affordable price point removes the financial barrier typical of advanced hacking tools, enabling these users to record webcam footage without consent and wield it as leverage against victims.
Given Minecraft’s status as one of the world’s most‑played games, the emergence of WeedHack underscores the importance of verifying mod sources, avoiding suspicious YouTube links, and steering clear of unknown Discord servers to protect younger players from covert intrusion.
"