A large-scale malware-spreading scheme targeting Minecraft players has continued to evolve despite the takedown of the threat actor’s malicious infrastructure in July.
In a new report, researchers at McAfee shared that over 6300 attempts to access malicious sites linked to the ‘WeedHack’ malware campaign were blocked by McAfee WebAdvisor in the past month.
WeedHack is a malware-as-a-service (MaaS) campaign spotted by McAfeee in July.
It utilized SEO poisoning techniques and malicious websites impersonating legitimate Minecraft clients and infected over 116,464 gamers with malware.
While the initial infrastructure underlying the campaign, including the command-and-control (C2) server, was taken down by McAfee in July, the researchers noticed that the campaign was still active in August.
“Consequently, we have observed a shift in tactics by these attackers,” McAfee researchers said, noting that threat actors have increasingly pivoted to file-hosting services such as Discord to distribute WeedHack.
Discord accounted for 49.6% of the links associated with WeedHack deployments identified by the cybersecurity firm, followed by MediaFire (23.4%), GitHub (8.2%), and Dropbox (4.6%).
The remaining URLs were customer-facing websites impersonating Minecraft resellers, sometimes offering paid tools for free to lure users into clicking on malicious links.
“In one case, the top two Google results observed by researchers for a popular Minecraft client led to sites distributing WeedHack, demonstrating how SEO poisoning can put malicious downloads directly in gamers’ paths,” the researchers wrote.
Researchers also identified a malicious site built using an AI-powered website creation platform.
To avoid falling into the trap the threat actor has set up for them, McAfee researchers recommended that gamers download mods, clients and other files only from trusted, official sources, while avoiding suspicious offers such as free versions of paid tools or cracked software.
They also advised keeping security software enabled, scanning downloads before opening them and checking URLs carefully for lookalike domains that could lead to malicious sites.
Image credits: Mehaniq / Shutterstock.com