The Weedhack Problem Starts With a Gaming Community and Ends on a Corporate Network
McAfee Labs has been tracking Weedhack since January 2026, and the numbers it has produced are striking for a campaign built around a video game. Over 3,800 unique malicious JAR files. More than 240 distribution URLs. YouTube channels running demonstration videos that route viewers straight to malware downloads. SEO poisoning is pushing those pages toward the top of search results for anyone looking for Minecraft mods or clients.
The initial payload is a JAR file called DonutDupe.jar, downloaded from sites built to look like legitimate Minecraft mod repositories. What happens next is technically more interesting than most consumer malware campaigns bother with. DonutDupe retrieves its command-and-control server address using EtherHiding — a technique that uses the Ethereum blockchain as a dead drop resolver. The C2 domain lives on-chain. It can’t be sinkholed. It can’t be taken down through domain registration abuse. It rotates freely because blockchain data is immutable and doesn’t depend on DNS infrastructure that law enforcement or security vendors can disrupt.
From the C2, a second JAR arrives. Then a third. Then a fourth. Each stage has a specific function — system reconnaissance, Microsoft Defender exclusion configuration, persistence establishment, and finally Component.jar, which deploys the actual remote access features. The chain is modular and deliberately staged so that each component looks innocuous in isolation.
What the final component delivers is where this crosses from nuisance malware into genuine enterprise exposure territory.
Five Dollars a Month Buys Capabilities That Would Have Required Nation-State Resources a Decade Ago
The Weedhack MaaS platform operates in two tiers. The free version — genuinely free, no payment required — includes a comprehensive infostealer capable of harvesting credentials from 36 browsers, session data from four Minecraft launchers, cookies, screenshots, files, and credentials for Discord, Steam, and Telegram. It targets 56 browser-based cryptocurrency wallets and 12 desktop wallet applications. For nothing.
The premium tier starts at $4.99 per month. What that buys is webcam access, keylogging, reverse shell execution, screen sharing with full keyboard and mouse control, and arbitrary file upload and download capability. A lifetime license costs $24.99.
Those are remote access trojan capabilities at a price point accessible to virtually anyone. The Telegram channel advertising the service has over 850 members and provides customer support, product updates, and what amounts to an onboarding experience for new criminal operators. McAfee Labs found evidence that a significant portion of the customer base appears to be teenagers and young adults, and that some are actively using the webcam access to record victims and share the footage in the Telegram channel as trophies.
The cyberbullying dimension is genuinely disturbing and deserves attention independent of the security implications. But the enterprise security implication runs parallel to it. When a tool with full remote access capability, credential harvesting across 36 browsers, and keylogging is available for $4.99 and actively marketed to a customer base with almost no technical barrier to entry, the question isn’t whether enterprise employees are being hit by it. It’s how many already have been.
Weedhack’s infections are concentrated in the US, Germany, India, the UK, and Italy — geographies with dense enterprise workforces. Employees who play Minecraft on personal machines that connect to corporate VPNs, sync files to cloud storage, or cache browser credentials for corporate SSO platforms are the bridge between a gaming-focused consumer malware campaign and an enterprise breach. That bridge gets crossed more often than security teams tend to assume.
CountLoader Has Already Compromised 86,000 Machines — including yours, possibly.
Running alongside the Weedhack disclosure is McAfee’s analysis of CountLoader, a JavaScript loader distributed primarily through cracked software sites that has compromised an estimated 86,000 unique machines globally. Approximately 9,000 of those infections spread via USB drives and removable media, a propagation vector that doesn’t require any user to visit a malicious site or download anything intentionally.
CountLoader’s execution chain is straightforward but effective. An EXE launches a PowerShell command that downloads an obfuscated JavaScript loader executed through mshta.exe. It establishes persistence, phones home to the C2, attempts USB propagation, and waits for payload instructions. The latest payload delivered through the infrastructure is a cryptocurrency clipper that monitors clipboard contents and silently substitutes cryptocurrency wallet addresses when it detects that the user has copied one. Send crypto to an address you copied from a legitimate source, and the money goes somewhere else entirely.
McAfee was able to sinkhole CountLoader’s communication infrastructure by registering a fake C2 domain — a meaningful defensive action that disrupted the active campaign infrastructure. The historical payload list is worth noting regardless: CountLoader has delivered Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and PureMiner across different campaign phases. A loader infrastructure that has delivered Cobalt Strike beacons at scale is not a consumer malware story. It is an enterprise intrusion story wearing consumer distribution clothing.
The infection geography — heaviest in India, Indonesia, the US, and Southeast Asia — tracks with large concentrations of software development and IT operations workforces. Developer machines running cracked software tools are not hypothetical. They exist in enterprise environments, including some that would be genuinely surprised to discover it.
Pirated Streaming Sites Are Still Running a Years-Long Crypto Mining Campaign Nobody Fully Stopped
The third campaign in this cluster is the least novel technically but perhaps the most instructive about threat actor persistence. Kaspersky has documented a campaign using illegal movie and TV streaming sites to deliver cryptocurrency miners through fake video player plugin updates that has been running, in various forms, since at least April 2023, when NTT Security first documented it.
The current variant downloads a ZIP archive that uses DLL sideloading to drop a fork of SilentCryptoMiner. The malware configures Defender exclusions, kills Microsoft’s Malicious Software Removal Tool, disables system sleep and hibernation to maximize mining runtime, launches both XMRig-based CPU and GPU miners, and deploys a RAT agent capable of running arbitrary commands, launching executables, and executing shellcode. It also includes a watchdog component that ensures the miner keeps running even if individual processes are terminated.
The fake plugin update delivery mechanism is worth examining. Users on pirated streaming sites have been conditioned to expect update prompts for media players — these sites frequently use outdated or unofficial plugins as part of their infrastructure. A convincing fake update prompt on a site the user already trusts enough to use for piracy is not a difficult social engineering challenge. The campaign has stayed alive for over two years by being exactly as convincing as it needs to be against exactly the audience it’s targeting.
That audience, again, includes employees. Not hypothetical employees at some abstract other organization — employees at organizations where security teams have deployed endpoint protection, established acceptable use policies, and trained staff on phishing awareness. None of those controls is particularly effective against someone visiting a pirated streaming site on a personal device during lunch.
Why Consumer Malware Is Now an Enterprise Security Budget Conversation
The collective picture these three campaigns paint has a specific implication for how enterprise security leaders should be thinking about threat scope.
Security programs are built around protecting enterprise assets from enterprise-targeted threats. The perimeter model that framing implies sophisticated attackers going after corporate infrastructure through corporate-facing attack surfaces — is increasingly inadequate when the actual breach path runs through a $4.99 Minecraft malware subscription, a cracked software download on a developer’s personal laptop, or a fake video player update on a streaming site accessed from a coffee shop.
BYOD policies, cloud-synchronized credentials, VPN access from personal devices, and browser-based SSO that persists session tokens across personal and professional browsing contexts have collectively dissolved the boundary that used to keep consumer malware threats separate from enterprise security concerns. A keylogger on an employee’s personal machine that captures their corporate SSO credentials is an enterprise breach, regardless of how it got there.
Security awareness programs that address phishing and business email compromise but don’t extend to gaming platform risks, cracked software distribution, and pirated content sites are covering less than half the actual attack surface that enterprise credential exposure now spans. Endpoint detection deployed only on managed corporate devices misses the personal machines where an increasing proportion of credential theft actually happens.
None of this requires exotic new tooling. It requires an honest assessment of where employees actually spend their time online and what the security implications of that are — followed by security awareness content and, where technically feasible, endpoint controls that reflect that reality rather than the cleaner picture that acceptable use policies describe.
Research and Intelligence Sources: McAfee
To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com
