WeedHack (LoaderClient): Minecraft stealer sold as a service

WeedHack, also called LoaderClient, is a Minecraft account stealer sold as malware-as-a-service. It hides in fake Fabric mods, including a fake “hack client for DonutSMP”, sends your session token, then loads a second program that steals browser data, Discord and crypto wallets and can take remote control of the PC.

First analysed : 2026-03-06

How it spreads

• Fake Fabric mods and “clients” shared on Discord and download sites, for example a fake “Hide Item Frame” mod or “ChromiumClient”, presented as a hack client for DonutSMP.
• Each buyer gets a customised jar with a tracking ID stored in a file such as fabric.api.json or cfg.json.

What it does

• Reads your Minecraft username, UUID and session token and sends them to its server.
• Finds its server through an Ethereum smart contract (eth_call), so it cannot easily be blocked.
• Downloads a second jar into memory and runs it: it steals browser passwords and cookies, Discord tokens and crypto wallets, adds Windows Defender exclusions and can give remote control of the PC.
• Most of its code is compiled to native code (JNIC) to hide what it does.

How DonutScan detects it

• Recognises its classes, strings, tracking file and smart contract, and shows a “WeedHack” tag.
• Flags session token access, blockchain server lookup and code compiled to native libraries.

If you ran it

• From another device: change your Microsoft password and sign out everywhere, change your Discord password and turn on two-factor authentication, change your mail password and the passwords saved in your browser.
• Reset the PC: the second stage installs itself to survive a simple file deletion.

Indicators of compromise

Other families :Silent Net CasinoRigger Fractureiser Stargazers