Weedhack MaaS Operation Targets Minecraft Players with Sophisticated Malware Since at least January 2026, Weedhack a Malware-as-a-Service (MaaS) operation has been actively targeting Minecraft players with a low-cost, subscription-based toolkit designed for credential theft, cryptocurrency wallet extraction, and account hijacking. Marketed through SEO poisoning, YouTube promotions, and fake mod websites, the service lowers the barrier for novice threat actors, increasing risks for gaming communities, particularly younger users. The malware primarily spreads via trojanized Java Archive (JAR) files disguised as popular Minecraft clients and mods, including Meteor Client, Aristois, LiquidBounce, and Impact Client. Upon execution, it hides under javaw.exe, decrypts Ethereum JSON-RPC endpoints, and uses smart contracts to dynamically retrieve command-and-control (C2) servers, complicating takedown efforts. Researchers identified 32 distinct JSON-RPC endpoints, over 3,820 malicious JAR samples, and 240+ distribution URLs linked to the campaign. Weedhack employs multi-stage attacks, using JNIC obfuscation to evade reverse engineering. Initial reconnaissance gathers system metadata, installed software, and attempts to bypass Windows Defender. Subsequent payloads steal browser credentials, Discord tokens, Steam and Telegram logins, and Minecraft session data, enabling account takeovers without password disclosure. The service offers tiered subscriptions, with a free version supporting credential theft, wallet targeting, and screenshot capture. Premium tiers (starting at ~$5/month) add remote-access features like keylogging, screen sharing, file management, reverse shells, and webcam monitoring. A customer dashboard provides malware builders, tutorials, and leaderboards, gamifying infections reportedly amassing over 116,000 hits. Researchers found evidence of misuse for harassment and cyberbullying, including the sharing of webcam footage in criminal forums. Many customers appear to be teenagers or young adults, exacerbating risks in youth-centered gaming communities. The operation’s professional-looking distribution sites and decentralized infrastructure further amplify its reach. Defenders are advised to treat Java-based gaming software as high-risk vectors, as Weedhack’s obfuscation and blockchain-driven C2 evade traditional signature-based detection. Mitigation strategies include sandboxing mod files, enforcing least-privilege Java policies, and blocking known malicious domains and JSON-RPC endpoints.