Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning — Detection and Defense Guide

---
title: Browser Spawned Minecraft-Themed Installer Execution
id: 3f9c2a71-8b4d-4e6a-9c12-5d7e1f0a2b3c
status: experimental
description: Detects web browsers spawning executables or installers with Minecraft/launcher-themed filenames, consistent with SEO-poisoned fake game client delivery such as the Weedhack campaign.
references:
  - https://thehackernews.com/2026/08/weedhack-malware-spreads-via-fake.html
  - https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\vivaldi.exe'
  selection_name:
    Image|contains:
      - 'minecraft'
      - 'mc_launcher'
      - 'minecraftlauncher'
      - 'minecraft_launcher'
      - 'tlauncher'
      - 'modloader'
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\Temp\'
      - '\AppData\Local\Temp\'
  condition: selection_parent and selection_name and selection_path
falsepositives:
  - Users legitimately downloading third-party launchers from official project sites (verify domain and signature before whitelisting)
level: high
---
title: Minecraft-Themed Executable Running Outside Legitimate Install Paths
id: 6a1e4d92-3c7b-4f58-a2d9-8e0b1c4d6f7a
status: experimental
description: Detects Minecraft/launcher-themed executables running from user-writable directories rather than official Microsoft Store or Mojang install locations. Fake clients distributed via SEO poisoning (e.g., Weedhack) execute from Downloads, Temp, or AppData.
references:
  - https://thehackernews.com/2026/08/weedhack-malware-spreads-via-fake.html
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|contains:
      - 'minecraft'
      - 'minecraftlauncher'
      - 'minecraft_launcher'
  selection_userpath:
    Image|contains:
      - '\Users\'
  filter_legit_profile:
    Image|contains:
      - '\.minecraft\'
    Image|endswith:
      - '\javaw.exe'
      - '\java.exe'
  condition: selection_name and selection_userpath and not filter_legit_profile
falsepositives:
  - Rare portable launcher setups; validate code signature and download source
level: high
---
title: Persistence Created Within Minutes of Browser-Delivered Game Installer
id: 9c4b7e15-2a8d-4f63-b1e4-7d3a5c8f0e2b
status: experimental
description: Detects Run key or scheduled task persistence referencing executables in Downloads or Temp with gaming-themed names, consistent with droppers staging persistence after fake client installation.
references:
  - https://thehackernews.com/2026/08/weedhack-malware-spreads-via-fake.html
  - https://attack.mitre.org/techniques/T1060/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
  selection_value:
    Details|contains:
      - '\Downloads\'
      - '\Temp\'
  condition: selection_key and selection_value
falsepositives:
  - Some legitimate updaters register Run entries from user paths; correlate with unsigned binaries and recent browser download events
level: medium

// Hunt: Fake Minecraft client delivery and execution (Weedhack-style SEO poisoning)
let GameTerms = dynamic(["minecraft", "minecraftlauncher", "minecraft_launcher", "tlauncher", "modloader"]);
let Downloads =
    DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FolderPath has_any (GameTerms)
    | where FolderPath has_any ("\\Downloads\\", "\\Temp\\")
    | where FileName endswith ".exe" or FileName endswith ".msi"
    | project FileCreateTime=TimeGenerated, DeviceId, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine;
Downloads
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | project ProcTime=TimeGenerated, DeviceId, ProcessFileName=FileName, ProcessCommandLine, ProcessSHA256=SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
) on DeviceId
| where ProcessFileName =~ FileName or ProcessCommandLine has FileName
| extend ExecutedAfterDownload = (ProcTime >= FileCreateTime and ProcTime <= FileCreateTime + 2h)
| where ExecutedAfterDownload
| project FileCreateTime, ProcTime, DeviceName, FileName, FolderPath, SHA256, AccountName, ProcessCommandLine, InitiatingProcessFileName1=InitiatingProcessFileName
| order by FileCreateTime desc;
// Optional pivot: network connections from these hosts shortly after execution
let SuspectHosts = Downloads | summarize by DeviceName;
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where DeviceName in (SuspectHosts)
| where InitiatingProcessFileName has_any (GameTerms)
| where RemotePort in (80, 443, 8080, 8443)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP), Domains=make_set(RemoteUrl) by DeviceName, InitiatingProcessFileName
| order by FirstSeen desc;

-- Hunt for Minecraft-themed executables running from user-writable paths (Weedhack triage)
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       authenticode(filename=Exe).Trusted AS SignatureTrust
FROM pslist()
WHERE (Exe =~ '(?i)minecraft|minecraftlauncher|tlauncher|modloader')
  AND (Exe =~ '(?i)\\\\Users\\\\')
  AND NOT (Exe =~ '(?i)\\\\.minecraft\\\\' AND Name =~ '(?i)javaw|java')

-- Companion: enumerate themed binaries staged in Downloads/Temp/AppData in the last 30 days
SELECT FullPath, Size, Mtime,
       authenticode(filename=FullPath).Trusted AS SignatureTrust
FROM glob(globs=['C:/Users/*/Downloads/**/*minecraft*.exe',
                 'C:/Users/*/Downloads/**/*launcher*.exe',
                 'C:/Users/*/AppData/Local/Temp/**/*minecraft*.exe',
                 'C:/Users/*/AppData/Roaming/**/*minecraft*.exe'])
WHERE Mtime > (now() - 2592000)
  AND NOT FullPath =~ '(?i)\.minecraft'

# Weedhack / fake Minecraft client triage - run elevated on suspect hosts
$ErrorActionPreference = 'SilentlyContinue'
$terms = 'minecraft','minecraftlauncher','tlauncher','modloader'
$report = @()

# 1. Find themed executables in user-writable locations
$paths = @("$env:SystemDrive\Users\*\Downloads",
           "$env:SystemDrive\Users\*\AppData\Local\Temp",
           "$env:SystemDrive\Users\*\AppData\Roaming")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -Include *.exe,*.msi -Force |
        Where-Object { $n=$_.Name.ToLower(); $terms | Where-Object { $n -like "*$_*" } } |
        Where-Object { $_.FullName -notmatch '\.minecraft' } |
        ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            $report += [PSCustomObject]@{
                Type      = 'Executable'
                Path      = $_.FullName
                SigStatus = $sig.Status
                Signer    = $sig.SignerCertificate.Subject
                Modified  = $_.LastWriteTime
                Hash      = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
            }
        }
}

# 2. Persistence: Run keys pointing at user paths
foreach ($hive in 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
                  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
                  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce') {
    Get-ItemProperty -Path $hive | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match '\\Users\\' -and $_.Value -match 'Downloads|Temp'
        } | ForEach-Object {
            $report += [PSCustomObject]@{ Type='RunKey'; Path="$hive :: $($_.Name)"; SigStatus='n/a'; Signer=$_.Value; Modified=''; Hash='' }
        }
    }
}

# 3. Scheduled tasks with actions in Downloads/Temp
Get-ScheduledTask | ForEach-Object {
    $act = $_.Actions | Where-Object { $_.Execute -match 'Downloads|Temp' }
    if ($act) {
        $report += [PSCustomObject]@{ Type='ScheduledTask'; Path=$_.TaskName; SigStatus='n/a'; Signer=$act.Execute; Modified=''; Hash='' }
    }
}

$report | Format-List
$report | Export-Csv -Path "$env:TEMP\weedhack_triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "`nTriage report exported. Any 'NotSigned'/'HashMismatch' executables warrant isolation and memory capture before remediation." -ForegroundColor Yellow