WeedHack Minecraft Malware Survives C2 Takedown: Fake Client Sites Still Active, SEO Poisoning Puts Malicious Downloads at the Top of Google

McAfee Labs published a follow-up report on the WeedHack Malware-as-a-Service campaign this week, documenting ten active malicious sites and multiple file-hosting accounts that are still spreading the infostealer despite a disruption to its command-and-control infrastructure. Over the past month alone, McAfee WebAdvisor blocked more than 6,300 user attempts to reach these sites.

WeedHack was first spotted in early June 2026 when McAfee researcher Aayush Tyagi documented a Malware-as-a-Service operation that had been running since January and had logged 116,464 infected systems, adding between 2,000 and 3,000 new victims every day. The operation offered a free tier that anyone with a Discord account could access, a premium tier with webcam surveillance capability for $5 a month, and a dashboard letting operators view stolen credentials, configure custom payloads, and monitor victims in real time. It spread through fake Minecraft client websites, YouTube videos linking to malicious downloads, and SEO poisoning that pushed those fake sites to the top of search results for popular Minecraft tool names. The malware stole session cookies, passwords, browser data, and cryptocurrency wallet contents, and used EtherHiding, a technique that fetches the attacker’s active server address from the Ethereum blockchain, to maintain contact with its infrastructure even when individual servers were shut down.

“During our investigation of this campaign, we observed that most of these websites appear legitimate, as they are well-crafted and often mimic legitimate websites. We observed a series of dedicated brand-impersonation attacks targeting several popular Minecraft clients.” reads the report published by McAfee.

“We published the original article in the first week of July, and, as a result, we’ve seen a disruption in WeedHack’s campaign: its C2 server is no longer active. Consequently, we have observed a shift in tactics by these attackers.  “

The dashboard is gone. The distribution sites are not.

Each fake website copies the real tool’s features, FAQs, installation steps, developer information and even links to legitimate GitHub repositories. The sites look detailed and convincing, so most users have little reason to suspect anything.

The attackers also use search rankings to reach victims. Researchers found that the first two Google results for “Xenon Client,” a popular Minecraft client, led to fake sites distributing WeedHack. The sites offered installation guides, free and paid downloads, and links to the real Xenon Client GitHub repository. A player searching for the tool, clicking the first result and downloading the file could easily end up installing malware.

The campaigns exploit a structural weakness in the Minecraft modding community: many popular tools don’t have official websites, only GitHub pages and Discord servers. Nova-client.com is a fake website for a client that has no real website; the attackers built one and ranked it above the genuine GitHub repository. 22qq-client.com does the same for a Crystal PVP mod. For nova-client.com, the researchers specifically noted that the credits section lists generic team names instead of anyone who actually worked on the project, which is one of the cleaner ways to spot an impersonation if you know who the real developers are.

One site in the campaign was built using lovable.app, an AI-powered web application builder that accepts natural language instructions and produces working sites. The platform is legitimate; the use here is not. The ready availability of tools like this means the cost and technical skill required to launch a new convincing fake gaming site is now close to zero.

McAfee found that most malicious links came through Discord (49.6%), followed by MediaFire (23.4%), GitHub (8.2%) and Dropbox (4.6%). One Discord channel promoting fake DonutSMP clients had more than 1,900 members, while another site offered eight different mods that all delivered the same malware.

The campaign also spread through trusted Minecraft communities such as Planet Minecraft and EndMods, making the scams harder to spot because users already trusted these platforms.

McAfee recommends downloading mods and clients only from official developer repositories or trusted platforms such as Modrinth and CurseForge. If a tool asks you to disable antivirus protection, treat it as malware.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

Fake AI tools malware targets developers in a GitHub infostealer campaign using SmartLoader and blockchain C2. See how it works.

Related Posts:

• macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate
• DOUBLECUP: New ClickFix Loader Drops CountLoader and DeviceManager RAT
• Interlock Ransomware Abuses Volatility3 for Credential Theft

The post Fake AI Tools Malware Targets Developers Through GitHub appeared first on Daily CyberSecurity.

MedusaHVNC RAT uses hidden Windows desktops to remotely control browsers, steal data, and evade detection through legitimate system features.

Windows has always supported hidden desktops as a legitimate feature, useful for specialized software that needs a workspace the user never touches. It’s a niche capability most people never think about, buried deep in how the operating system manages sessions. Unfortunately, malware authors noticed that too, and BlackFog’s research team just dissected a new remote access trojan called MedusaHVNC that maliciously uses this feature.

“We recently came across a sample of MedusaHVNC, a new remote access trojan (RAT) being sold as malware-as-a-service (MaaS). When we took it apart, we found a hidden virtual network computing (HVNC) module that opens a browser on a separate Windows desktop, out of sight of the victim.” reads the report published by Blackfog. “The browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state. This gives the operator access to live, logged-in sessions while the activity continues to come from the victim’s usual machine.”

MedusaHVNC is marketed through its own website and Telegram channel as a malware-as-a-service platform. It includes in-memory execution of .NET and native payloads with AMSI and ETW bypasses, plus browser recovery features to steal passwords, cookies, and browsing history. It supports Chrome, Edge, Brave, Firefox, and Telegram, making credential and session theft easier.

The core feature is a hidden virtual network computing module that spins up a real browser on a separate desktop the victim never sees. BlackFog obtained a video showing an operator’s console with Google Chrome open on Google’s homepage, already signed into an account, alongside controls for adjusting frame rate and image quality like it’s a video call.

That level of polish tells you this wasn’t thrown together over a weekend. The client panel lets an operator pick which browser to run, Chrome, Edge, or Firefox, and configure the session before it even launches, turning account takeover into something closer to a point-and-click chore.

Getting there takes five stages, starting from something almost embarrassingly mundane. The chain kicks off when Windows Script Host runs an obfuscated JScript launcher, which pauses for exactly 7,584 milliseconds before rebuilding its files under a folder called Nx2981Okkr2 inside the Temp directory. That pause isn’t an accident; it’s the kind of small delay malware authors add to slip past sandboxes that only watch a sample for a few seconds. From there it drops an AutoIt interpreter, a config file, an encrypted payload with no file extension, and a batch script tucked into the Startup folder so the infection survives a reboot.

AutoIt, a completely legitimate Windows automation tool, then decrypts that payload using a single-byte XOR key, the value 0xAE, producing the first native 64-bit executable in the chain. That executable launches straight into charmap.exe, yes, the built-in Windows Character Map utility that ships on every machine. Sandbox data BlackFog reviewed shows charmap.exe spawning as a child of the AutoIt process, with the malicious loader injected directly into it, turning a completely trusted system binary into the payload’s hiding spot. Anyone scanning a process list for something suspicious would glance right past it, because nothing looks more boring than the character map tool.

Inside charmap.exe, the loader still isn’t done unwrapping itself. It runs a 16-byte repeating XOR pass across just over a million bytes of data, then a ChaCha20 decryption step using a 32-byte key and a 12-byte nonce, before the actual malware finally emerges. That’s three separate layers of obfuscation stacked on top of each other, each one designed to slow down anyone trying to reverse-engineer the sample by hand. BlackFog says it rebuilt that entire unpacking process offline and recovered the final payload byte for byte, which is about as thorough as forensic verification gets.

What comes out the other side is an unsigned 64-bit executable carrying the internal string MedusaHVNC. It talks to its operator over a custom protocol built on Windows’ native networking functions, and the command server address, 51.89.204.28 on port 4444, is baked directly into the binary rather than resolved dynamically. Fixed infrastructure like that is a tradeoff: simple for the attacker to run, but also a stable target defenders can block outright the moment they know to look for it.

Once the hidden session is live, the malware leans entirely on legitimate Windows capabilities to do its work. Screen and window capture ride on built-in functions like BitBlt, EnumWindows, and PrintWindow, while synthetic mouse clicks and keystrokes come through SendInput and SetWindowsHookExW. Clipboard functions round out the toolkit, giving the operator a simple way to move text and files into or out of the hidden session without ever touching a file transfer tool that might get flagged.

“Clipboard functions, including OpenClipboard, GetClipboardData, and SetClipboardData, provide another way to move information into or out of the session.” continues the report. “Taken together, these findings are consistent with the core HVNC workflow. The browser references identify the applications involved, and the capture, input, window-management, and clipboard functions provide the mechanisms needed to observe and control activity inside the hidden desktop.”

None of these are exotic hacking tools. They’re the same APIs legitimate remote-support software uses every day, which is exactly why watching process behavior alone won’t catch this. A security tool looking for “malicious” function calls will come up empty, because every single function involved has a completely ordinary, everyday use.

BlackFog’s own conclusion lands on the one place this scheme can’t hide: the network. Whatever happens inside that invisible browser, moving money, logging into accounts, copying data, still has to leave the machine to reach the operator, and that outbound connection looks the same whether it came from a hidden desktop or a plain remote-access tool. Blocking the known command server and the associated file hashes is a reasonable starting point for any team that wants to act today rather than wait for a signature update. It’s also exactly the layer BlackFog built its own anti-data-exfiltration product to watch, catching the connection in real time regardless of which process tries to make it, browser or otherwise.

Funny thing about building an invisible desktop: it’s only invisible until the data tries to leave the building, and buildings tend to have exits everyone’s watching.

“An unapproved connection to an attacker’s server is the same event whether it comes from a browser or a native client. Blocking traffic to known C2 infrastructure and alerting on unexpected outbound connections works regardless of how the session was hidden. Blocking the C2 address and the hashes in the IOC table is a concrete starting point.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, MedusaHVNC )

RedWing: The Android Banking Trojan You Can Rent on Telegram for Less Than a Coffee Subscription

Zimperium’s zLabs team has uncovered RedWing, an Android spyware operation sold as a subscription service through Telegram, with links to Russian threat actors and apparent roots in the Oblivion malware family.

It comes with documentation, tutorial videos, a referral discount program, and a bot that builds custom malicious apps on demand. No malware-writing skill required.

“Far from being just another basic piece of malware sold online, RedWing is a fully developed, commercial-grade MaaS product with seller documentation, videos, and a bot-driven subscription model that provides a low entry barrier for novice attackers.” reads the report published by Zimperium. “As a proof of this, the APK customization/obfuscation/creation can be fully implemented through telegram.”

Infection starts with a phishing link that opens a fake app store page. The dropper builder can mimic Google Play, the Samsung Galaxy Store, or Huawei’s AppGallery with fake ratings, reviews, and download counts.

“the C2 panel features a sophisticated ‘Onboarding Constructor‘. Within the ‘Stealer’ configuration module, operators can deploy a deceptive ‘WebView + Cards’ interface. This mechanism loads a benign-looking webpage in the background to establish legitimacy, while sequentially overlaying customized permission prompts (cards) from the bottom of the screen.” continues the report. “Through tailored social engineering lures, the malware coerces the user into granting critical system access, specifically targeting three core permissions: disabling Battery Optimization (to ensure uninterrupted background execution), setting the application as the Default SMS handler (crucial for intercepting 2FA codes), and access to Notifications.”

Once installed, the app walks the victim through permission screens one at a time, disable battery optimization, set the app as the default SMS handler, enable notifications, framed as routine setup steps.

With those permissions in place, RedWing has deep system access. It deploys fake login screens over real banking and crypto apps to steal credentials, reads incoming texts to capture one-time codes, and uses Android’s Accessibility Service to lift PINs, card numbers, and CVV values directly off the screen as they appear.

The malicious code also silently enables call forwarding using a hidden carrier code, 21, redirecting all incoming calls to an attacker-controlled number, which knocks out phone-based two-factor authentication and bank fraud-prevention calls in one move.

The researchers pointed out that the surveillance capabilities go further. RedWing can remotely activate a victim’s camera and microphone, recording audio through commands sent from the attacker’s server with configurable recording duration.

“The malware is capable of remotely activating the cameras and the microphone of an infected device (Fig. 12). This functionality is executed via specific commands. For instance, the <take_photo> command allows the attacker to remotely capture images using the device’s camera. Similarly, the <start_recording> command leverages the MediaRecorder API to capture ambient audio.” continues the report. “This audio recording process is managed entirely from the remote server, which allows the attacker to configure the exact duration of the recording, among other parameters.”

On top of that, operators get live screen streaming via VNC, a real-time keylogger, access to all files on the device, contact lists, call logs, and location tracking.

The targeting architecture reveals something telling about how RedWing is built. The apps it monitors through Accessibility are baked into each compiled copy, which points to a fresh APK being generated server-side each time a buyer specifies their targets. The overlay targets, by contrast, can be updated from the control panel at any time without distributing a new app.

Zimperium identified 82 targeted institutions across multiple sectors, with a heavy focus on Russian financial firms, one sample used a fake RuStore page, though the list can shift at any time from the operator’s dashboard.

RedWing doesn’t need any Android vulnerability to work. It relies entirely on the user installing an app from outside an official store and approving its permission requests. The first line of defense is what happens at install time: don’t install apps from links sent by text or messaging apps, don’t grant Accessibility or default-SMS access to apps with no clear reason to need them, and treat any app that hides its icon after installation as a red flag. On managed devices, sideloading can be blocked centrally and suspicious permission requests flagged automatically.

RedWing can also transform infected Android devices into a botnet capable of launching coordinated DDoS attacks. Through its control panel, attackers can command multiple compromised phones at once to send traffic floods against a target website or server, disrupting its availability and adding another capability beyond spying and data theft.

Because operators can reskin the app and swap its targets from the control panel, the app name is a poor indicator, behavior is what to watch for.

“The rapid rise of Malware-as-a-Service (MaaS) operations like RedWing shows how easily attackers can weaponize legitimate Android components to achieve full device compromise. Unlike older banking trojans that rely solely on overlays, RedWing integrates custom droppers, live screen streaming, and abuse of the SMS handler role and Accessibility to exfiltrate data and impersonate legitimate apps in real time.” concludes the report. “This blend of social engineering and hijacking the incoming calls makes this deep-system control especially dangerous in BYOD and consumer-facing environments where app-store trust is assumed.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Malware)