{"id":13888,"date":"2026-06-26T10:03:58","date_gmt":"2026-06-26T10:03:58","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/26\/minecraft-malware-loader-uses-rsa-signed-smart-contract-updates-for-persistent-c2\/"},"modified":"2026-06-26T10:03:58","modified_gmt":"2026-06-26T10:03:58","slug":"minecraft-malware-loader-uses-rsa-signed-smart-contract-updates-for-persistent-c2","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/26\/minecraft-malware-loader-uses-rsa-signed-smart-contract-updates-for-persistent-c2\/","title":{"rendered":"Minecraft Malware Loader Uses RSA-Signed Smart Contract Updates for Persistent C2"},"content":{"rendered":"

Minecraft Malware Loader Uses RSA-Signed Smart Contract Updates for Persistent C2
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A new and highly sophisticated malware loader has been found hiding inside what appears to be a harmless Minecraft mod. <\/p>\n

Researchers have uncovered a campaign that blends blockchain technology and social engineering to steal player credentials and deliver additional malicious payloads. <\/p>\n

The damage is already significant, with over 116,000 unique systems compromised since the campaign began in January 2026.<\/a><\/p>\n

The malware, known as LoaderClient, spreads as a fake Minecraft Fabric mod<\/a>. Once installed, it immediately harvests the player\u2019s session data, including display name, account UUID, and live Microsoft OAuth access token. <\/p>\n

That stolen token is especially dangerous because it can take over a victim\u2019s account without needing a password or bypassing two-factor authentication.<\/a><\/p>\n

Analysts at\u00a0DarkAtlas\u00a0identified and detailed the malware in a report<\/a> shared with Cyber Security News (CSN). <\/p>\n

Their findings reveal LoaderClient is the stage-one payload of a broader campaign called WeedHack, a Malware-as-a-Service platform available free or for five dollars a month. <\/p>\n

By June 2026, the operation had produced over 3,820 unique malicious files and was logging between 2,000 and 3,000 new infections daily.<\/p>\n

\n
\"Flixible
Flixible plans (Source \u2013 DarkAtlas)<\/figcaption><\/figure>\n<\/div>\n

What makes this threat alarming is how it spreads. Operators upload polished YouTube videos showcasing popular mods and bury malicious download links in the descriptions. <\/p>\n

They also run fake portals that impersonate legitimate mod sites<\/a> and rank highly through SEO poisoning. Because players are conditioned to dismiss antivirus warnings as false positives, many disable their defenses and run the malware unknowingly.<\/a><\/p>\n

The campaign has grown a community of over 850 registered operators on Telegram, many of them teenagers using the tools for peer harassment, webcam access, and social media hijacking. <\/p>\n

This shift reflects how low-cost malware is increasingly weaponized for personal disputes rather than purely financial crime.<\/a><\/p>\n

Minecraft Malware Loader Uses RSA-Signed Smart Contract Updates<\/strong><\/h2>\n

What sets LoaderClient apart is its command-and-control architecture. Instead of embedding a server address in the code, the malware queries an Ethereum smart contract to retrieve its active C2 URL using a technique called EtherHiding. <\/p>\n

This makes the infrastructure nearly impossible to disrupt through domain seizures or hosting provider action.<\/p>\n

\n
\"Video
Video tutorials and guides (Source \u2013 DarkAtlas)<\/figcaption><\/figure>\n<\/div>\n

The smart contract responds with a URL paired with an RSA digital signature. The malware then verifies that signature against a hardcoded 2048-bit RSA public key before trusting the address. <\/p>\n

Only the operator\u2019s private key can produce a valid signature, so even tampering with the contract would be rejected, making sinkholing attacks useless.<\/a><\/p>\n

Once the C2 URL is verified, LoaderClient downloads the stage-two payload entirely in memory, never writing a file to disk. That payload is compiled using JNIC v3.7.0, hiding all logic inside encrypted native Windows DLLs. <\/p>\n

It independently re-resolves C2 through the same Ethereum contract<\/a> and uses DNS-over-HTTPS to evade corporate network monitoring. The Ethereum contract address is the most durable indicator of this campaign, living permanently on the blockchain.<\/a><\/p>\n

Detection Evasion and Defense Recommendations<\/strong><\/h2>\n

LoaderClient layers multiple evasion techniques to avoid detection at every stage. All sensitive strings are encrypted using a custom cipher called decS, producing non-standard Unicode characters that defeat signature-based tools. <\/p>\n

The JAR also contains a 442-megabyte zip bomb compressed to roughly 665 kilobytes, designed to crash automated scanners and bypass upload size limits.<\/a><\/p>\n

The stage-two module escalates privileges through a CMSTP UAC bypass, silently approving elevation prompts without any input from the victim. <\/p>\n

\n
\"Weedhack
Weedhack Chat (Source \u2013 DarkAtlas)<\/figcaption><\/figure>\n<\/div>\n

A scheduled task called JMonitoringTask runs every two minutes as a watchdog, while another named JavaSecurityUpdater activates at login with the highest system privileges. <\/p>\n

Windows Defender is manipulated to add exclusion paths<\/a> that prevent scanning of the dropped files. <\/a>Defenders are advised to block Ethereum RPC traffic on gaming and educational networks, since no legitimate Minecraft activity requires blockchain calls. <\/p>\n

Organizations should monitor the Ethereum contract on Etherscan for URL rotation history, which leaves a permanent public record of operator activity. <\/p>\n

Deploying the published YARA detection rules and rotating affected credentials immediately after any suspected infection are both essential steps to limit further damage.<\/a><\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
SHA256<\/td>\nF91714F89616002C6C1411233470F58E74FAD7CB5A7DA6F77AA6082F5D2E8771<\/td>\nStage-1 LoaderClient JAR file hash<\/td>\n<\/tr>\n
SHA1<\/td>\nF7911F5BE3D08DA95DCDA8AFB1BEB8E462376F9D<\/td>\nStage-1 LoaderClient JAR file hash<\/td>\n<\/tr>\n
MD5<\/td>\nD991A7C9E2C3B269975404405A79ADBC<\/td>\nStage-1 LoaderClient JAR file hash<\/td>\n<\/tr>\n
SHA256<\/td>\nE7D1346153B49CE403687BBD0DDBF1DB63DE6808D64EA2812EA48EF0CFE7CF2A<\/td>\nStage-2 Module.jar file hash<\/td>\n<\/tr>\n
Ethereum Contract<\/td>\n0x1280a841Fbc1F883365d3C83122260E0b2995B74<\/td>\nEthereum smart contract used for C2 URL resolution (EtherHiding)<\/td>\n<\/tr>\n
Domain<\/td>\nfucktermedfir[.]st<\/td>\nCurrent active C2 domain resolved from smart contract<\/td>\n<\/tr>\n
Domain<\/td>\nwhnewreceive[.]ru<\/td>\nPrevious C2 domain (active March 2026)<\/td>\n<\/tr>\n
URL<\/td>\nhttps:\/\/fucktermedfir[.]st\/files\/jar\/module<\/td>\nStage-2 payload download URL<\/td>\n<\/tr>\n
WebSocket<\/td>\nwss:\/\/remotev2.whpayment[.]ru\/ws\/client<\/td>\nPrimary WebSocket C2 endpoint for premium RAT<\/td>\n<\/tr>\n
WebSocket<\/td>\nwss:\/\/remotev2.whreceive[.]ru\/ws\/client<\/td>\nBackup WebSocket C2 endpoint for premium RAT<\/td>\n<\/tr>\n
Domain<\/td>\ntelemetrydata[.]to<\/td>\nData exfiltration endpoint<\/td>\n<\/tr>\n
IPv4<\/td>\n45.141.119.34 (Port 50169)<\/td>\nNetwork indicator associated with campaign<\/td>\n<\/tr>\n
File Path<\/td>\n%APPDATA%RoamingRuntimeBroker.exe<\/td>\nDropped backdoor location on infected host<\/td>\n<\/tr>\n
File Path<\/td>\n%APPDATA%RoamingMicrosoftTlmtryTelemetry.exe<\/td>\nDropped stealer location on infected host<\/td>\n<\/tr>\n
File Path<\/td>\n%APPDATA%RoamingWindowsRunetimeBroker.exe<\/td>\nBackup payload location on infected host<\/td>\n<\/tr>\n
File Path<\/td>\n%TEMP%lib*.dll<\/td>\nNative DLL dropped by JNIC loader<\/td>\n<\/tr>\n
File Path<\/td>\n%TEMP%*.acdm<\/td>\nConfiguration file dropped on infected host<\/td>\n<\/tr>\n
Registry Key<\/td>\nHKCUSoftwareMicrosoftWindowsCurrentVersionRun<\/td>\nPersistence registry key used by malware<\/td>\n<\/tr>\n
Scheduled Task<\/td>\nJMonitoringTask<\/td>\nWatchdog task running every 2 minutes<\/td>\n<\/tr>\n
Scheduled Task<\/td>\nJavaSecurityUpdater<\/td>\nPersistence task running at LOGON with HIGHEST privilege<\/td>\n<\/tr>\n
JAR Resource<\/td>\nMETA-INF\/README.txt<\/td>\nZip bomb entry inside malicious JAR<\/td>\n<\/tr>\n
JAR Resource<\/td>\ncfg.json<\/td>\nEmbedded config file containing campaign UUID<\/td>\n<\/tr>\n
File Extension<\/td>\n.acdm<\/td>\nCustom file extension used for dropped config files<\/td>\n<\/tr>\n
Campaign UUID<\/td>\n6fb0a044-eb0c-4d1f-b497-827b715590a7<\/td>\nOperator-assigned campaign identifier embedded in stage-1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong> Google<\/a><\/strong><\/strong>.<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n

The post Minecraft Malware Loader Uses RSA-Signed Smart Contract Updates for Persistent C2<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Minecraft Malware Loader Uses RSA-Signed Smart Contract Updates for Persistent C2 A new and highly sophisticated malware loader has been found hiding inside what appears to be a harmless Minecraft mod. Researchers have uncovered a campaign that blends blockchain technology and social engineering to steal player credentials and deliver additional malicious payloads. The damage is […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-13888","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13888"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13888"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13888\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13888"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13888"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13888"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}