Stealer-creeper: how fake Minecraft mods steal your data

We all love trying new mods and discovering useful features for Minecraft. But now, under the guise of harmless add-ons and cheats, a serious threat is lurking. Cybersecurity experts have discovered a dangerous application that stealthily steals gamers' personal data. Let’s dive into how this digital «creeper» works and how to protect your accounts from being hacked.

The trap in short videos

Cybercriminals have chosen an extremely popular platform to find new victims — TikTok. Through dynamic videos, they promote «duplication cheats» and unique modifications that promise quick riches on servers. The links in the descriptions lead to downloads of the required archives.

Instead of endless diamonds or new mechanics, you download an infostealer called WeedHack onto your computer. Criminals exploit players' desire for easy advantages, skillfully disguising the dangerous code as useful gaming tools.

Silent theft in the background

The downloaded files have the familiar .JAR extension. Once launched, they actually work as the claimed mods, completely lulling your vigilance. While you’re building your base, the malicious code quietly downloads additional modules from hacker servers and begins collecting information.

The WeedHack infostealer has a frightening set of features. It extracts passwords from over 40 browsers, steals Minecraft and Discord session tokens, and collects data from dozens of cryptocurrency wallets. Particularly dangerous is its ability to copy information from the tdata folder of the Telegram messenger. This gives hackers full access to your messages and account without needing a verification code. For many gamers, the consequences are devastating: they lose not only progress on their favorite servers but also access to personal finances.

Server blocking and combating the threat

Cybersecurity specialists from the F6 company quickly responded to the new scheme. They carefully studied the criminals' infrastructure and identified 20 control servers through which the malicious program transmitted stolen data.

Fourteen of these servers were located in the .RU domain. They are now completely blocked, significantly disrupting the hackers' network. Additionally, experts submitted official complaints to TikTok’s technical support to promptly remove videos with dangerous links.

How to protect your computer

To keep your account and personal data safe, we recommend following a few simple rules:

• Download mods and texture packs only from large, reputable portals with good reviews.
• Avoid clicking on links in video descriptions on social media.
• Use reliable antivirus software with up-to-date databases and do not disable it when launching new games.
• Check any suspicious files in public online sandboxes before opening them on your computer.

The emergence of the WeedHack virus reminds us that downloading cheats from unknown sources always carries a huge risk. Be mindful of what you install on your PC and make sure to warn your server friends.

Have you ever encountered suspicious mods or strange download links? Share your experience in the comments — let’s discuss how to make our gaming community safer.