The malicious Minecraft mod infected 116,000 PCs, giving attackers access to users’ cameras.

McAfee Labs Reveals Large-Scale Cyber Campaign Targeting Minecraft Users

McAfee Labs specialists discovered a large-scale attack on fans of the popular game Minecraft. Hackers are spreading malicious code called WeedHack, disguising it as free mods and within alternative game clients.

Scope of the Attack – Since early 2026, more than 116,000 successful infections have been recorded.

- Daily new victims range from 2,000 to 3,000 people.
- The tool’s success is attributed to its low cost and ease of use.

How WeedHack Works
1. Subscription as a Service – the product is presented as a legitimate service with a user-friendly dashboard.
2. A basic set of scripts is available for free via a Discord account.
3. For $5, users purchase premium status, which unlocks:
- remote access to passwords,
- reading personal files,
- covert activation of webcams.

Target Audience – The low price attracted many schoolchildren and students.
- Researchers from the virus creators’ Telegram channel found that young people use WeedHack not for stealing banking data but for harassment:
- they record players on video via their webcam,
- publish videos as “trophies” in chats,
- blackmail victims by revealing their real location.

Platform Response – The messenger administration has already removed the main offender community, which had about 850 members.

Thus, McAfee Labs underscores the danger of WeedHack as a cheap and simple tool for cyber fraud and harassment among youth.