Minecraft players seeking popular clients are being misled into installing malware, as a renewed campaign under the WeedHack name manipulates search engine results, McAfee analysts have discovered. Fake sites posing as legitimate client download pages are using cloned branding, fake installation guides, and misleading links—some even mimicking real GitHub projects—to spread dangerous Java payloads.([cybersecuritynews.com](https://cybersecuritynews.com/google-results-minecraft-client/))
Fake Downloads Rank First in Search Results
Investigations revealed that searches for “Xenon Client” bring up fraudulent domains like xenoclient.lol and xenonclient.com in the top Google results. These sites borrow language and visuals from genuine clients, offering what look like legit free or premium versions, FAQs, and installation instructions, all designed to deliver malware instead of actual game tools.([cybersecuritynews.com](https://cybersecuritynews.com/google-results-minecraft-client/))
The campaign targets not just Xenon Client but also Radium Client, SeedCrackerX, Nova Client, Meteor Client, and 22qq-client, according to McAfee. In some cases, the threat actors capitalize on projects that lack an official standalone website, allowing their malicious clones to outrank legitimate listings on platforms like GitHub.([cybersecuritynews.com](https://cybersecuritynews.com/google-results-minecraft-client/))
Broad Attack Vectors & Distribution Channels
Attackers employ a variety of platforms to host and distribute the malware. Nearly half of the observed malicious links were Discord-based, with others using MediaFire, GitHub, Dropbox, and known mod sites like Planet Minecraft and EndMods. These familiar services make it easier for compromised files to appear credible when shared in community chats and forums.([cybersecuritynews.com](https://cybersecuritynews.com/google-results-minecraft-client/))
Despite efforts to disrupt the campaign’s command-and-control infrastructure, the underlying distribution network remains active. McAfee WebAdvisor alone blocked over 6,300 attempts to reach malicious sites in one month, while earlier work tied WeedHack to more than 116,000 infected players.([cybersecuritynews.com](https://cybersecuritynews.com/google-results-minecraft-client/))
How to Stay Safeguarded
To reduce risk, players should avoid clicking the first download link in search results. Instead, go directly to developers’ verified pages or trusted mod platforms. Comparing full URLs closely, rejecting offers for free premium clients, and treating any request to disable security software as a serious red flag are essential steps.([cybersecuritynews.com](https://cybersecuritynews.com/google-results-minecraft-client/))
All downloadable files—mods, installers, archives, JARs—should be scanned before opening, even when appearing to come from well-known sources. Priority should also be given to keeping systems, browsers, the game itself, and security tools fully updated. Community leaders and server operators must share verified download links and alert others to lookalike sites when they surface.([cybersecuritynews.com](https://cybersecuritynews.com/google-results-minecraft-client/))
Indicators of compromise include fake domains like glazed-client.com, radium-client.com, xenonclient.com, meteorclients.com, and malicious repositories or download URLs tied to WeedHack over platforms like Discord, GitHub, Planet Minecraft, and EndMods.([cybersecuritynews.com](https://cybersecuritynews.com/google-results-minecraft-client/))
This isn’t an isolated or novel issue. The same methods—clone domains, SEO poisoning, malicious redirects—have been used across the gaming ecosystem and beyond. Offering a fake, “free premium” version of paid software or cheats is a classic technique that entices users into infected downloads.([cybersecuritynews.com](https://cybersecuritynews.com/google-results-minecraft-client/))
What makes this active WeedHack campaign particularly concerning is how it adapts. Even with takedowns of its central infrastructure, fresh distribution routes appear immediately. It underscores a bigger trend: attackers shifting tactics to exploit trust in search engines, community platforms, and well-known mod tools.
For serious protection, it’s essential to know where you download from and to err on the side of caution every time a site looks off—no matter how convincing. This incident is a reminder that in digital environments, polish and popularity are not guarantees of safety. These kinds of campaigns show just how quickly and quietly malware can spread among players—and why online hygiene matters more than ever.
