SURIQ
Taking down a malware operation's command server is supposed to end the campaign. With Weedhack it did not. McAfee Labs pulled the plug on the infostealer's original control server, and the operators simply pointed it somewhere new by reading a fresh address off the Ethereum blockchain. The malware kept running. McAfee still counts between 2,000 and 3,000 new infections a day, delivered through fake Minecraft client sites that outrank the real projects in search results. The interesting part is not the gaming lure. It is that the usual defender win, seizing the infrastructure, no longer applied.
Why the takedown did not stop it
The technique is called EtherHiding. Instead of hardcoding a control-server address that investigators can identify and seize, the operators wrote the current address into an Ethereum smart contract and had the malware read it from the public ledger. According to McAfee's follow-up, published via Security Affairs, once the original server went offline the attackers shifted tactics and the distribution kept going: ten malicious sites and multiple file-hosting accounts stayed live, and McAfee's browser protection blocked more than 6,300 access attempts in a single month.
Nobody can unpublish an entry from a public blockchain, so there is no server to take offline and no domain to sinkhole. The address book itself is now hosted on infrastructure that is deliberately censorship-resistant. We saw the same play in July with the Dysphoria botnet, which hid its command channel on a blockchain to survive takedowns. What is new is the crowd using it. Blockchain-anchored control is migrating out of nation-state and botnet tooling and into a commodity password stealer that targets teenagers playing Minecraft. That should reset expectations about what a takedown headline actually buys you.
How it reaches the machine
Weedhack rides search. The operators build fake download pages for popular Minecraft clients, then use SEO poisoning to push those decoys above the genuine projects on every major search engine, Google and Bing as well as Brave and DuckDuckGo. McAfee's research, reported by The Hacker News, found that the top results for a search like "Xenon Client" led to fake distribution sites, and that the crew even stood up sites for tools that had no official page of their own, ranking above the real GitHub repositories. Impersonated projects include names like glazedclient, radiumclient, meteorclients and nova-client, often on typosquatted domains. One of the fake sites was built with lovable.app, an AI website builder, which is a reminder that spinning up a convincing decoy now costs almost nothing.
The actual payloads do not live on those sites. They sit on file-hosting services and chat platforms that most environments treat as trusted:
Discord's content-delivery network carried 49.6% of the malicious URLs, MediaFire 23.4%, GitHub 8.2% and Dropbox 4.6%. The practical lesson is that "download the top search result" has become an attack path. Search ranking is not a trust signal, and neither is a familiar file-hosting domain. The control that holds here is pinning software to known-good sources and verifying downloads by hash, not trusting whichever page Google floated to the top this morning.
What it does once it runs
Weedhack is sold as a service. When the operation launched in January 2026 it offered tiers: free access through Discord, a premium option with webcam surveillance for about $5 a month, and an operator dashboard for viewing stolen credentials, configuring custom payloads and tracking victims. By June, McAfee's telemetry logged 116,464 infected systems. That is the machine behind the gaming lure.
On a Windows host the infection runs through a multi-stage sequence that ends in a Java payload. It collects system information, adds itself to Microsoft Defender's exclusion list so on-host scanning skips it, and then steals data: session cookies, saved passwords, browser data and cryptocurrency wallet contents. The .jar execution and the Defender exclusion write are the two behaviors worth burning into memory, because they are the part that does not change when the control address rotates.
This is not only a gaming problem
It is easy to file this under "kids installing cheats" and move on. That misreads the exposure. The prize here is session cookies and browser data, and a stolen session cookie sidesteps a password reset the same way ACR Stealer's live-session theft did: the attacker replays your authenticated session and never touches the login form or the second factor. Now think about where game clients get installed. Family-shared laptops. A developer's personal machine that also holds cloud tokens and a logged-in browser. A BYOD device that touches corporate SaaS. The malware does not know or care that the same profile holds a work session, and neither does the person who reset their password and assumed they were clean.
Detect the behavior, not the address
Because the control address is now disposable, blocking it is a losing game. The durable signal is on the endpoint, and it is behavioral. A game or mod installer that writes an entry to Microsoft Defender's exclusion list is a high-confidence lead on its own; almost nothing legitimate in that context needs to exclude itself from antivirus. Pair that with an installer or a browser-download process spawning java to run a .jar, and you have a detection that survives every C2 rotation the operators can pull off the blockchain. We flagged the same principle when a signed installer became a backdoor after malware turned Microsoft Defender off: watch the tampering, not the file hash.
For delivery, the fix is boring and effective. Treat search results as untrusted for software downloads, allow-list the sources your users are permitted to install from, and verify by published hash. This is the kind of endpoint-behavior and delivery-integrity monitoring a managed detection team runs continuously; our threat hunting write-up covers the hunt side. And if a machine is already hit, a password reset is step one, not the finish. Revoke active sessions, rotate anything that was logged in, and treat any crypto wallet on that host as compromised.
The larger shift is the one to plan around. When the address book moves onto a public blockchain, "we took down the C2" stops being the end of the story. Expect more commodity malware to borrow the trick, and build detections that never depended on knowing where the server lives.