A malware-as-a-service campaign dubbed Weedhack has been targeting Minecraft players since January 2026, distributing malware through YouTube by impersonating legitimate Minecraft clients and mods. The campaign has compromised thousands of systems and is linked to a loader dubbed CountLoader, which has recorded over 86,000 infections. The threat is notable for its exploitation of gaming communities and pirated software channels as a delivery mechanism for system-control malware.

Architect’s Take: While this campaign primarily targets consumers, architects should review endpoint security policies for corporate devices that may have gaming software installed, and ensure DNS filtering and web proxies block known malicious YouTube redirect chains and payload-hosting domains associated with Weedhack. Consider adding gaming and piracy-related domains to URL category block lists on managed endpoints.

Original advisory: Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content