A data breach doesn’t have to hit the company you shopped with directly to put your information at risk. 

That’s the lesson from this week’s Pokémon Center breach. Customers in the United Kingdom and Germany are being notified that personal and order information was exposed after attackers compromised CEVA Logistics, the third-party company used to fulfill and ship Pokémon Center orders. 

The good news: Pokémon Center says CEVA did not have access to customers’ payment-card information.  

The bigger concern is what criminals could potentially do with the information that was exposed, particularly when it can make a phishing message look unusually convincing. 

What Happened in the Pokémon Center Data Breach? 

According to breach notifications reviewed by BleepingComputer, attackers may have obtained Pokémon Center customers’ full names, mailing addresses, phone numbers, email addresses, and information about the products they ordered. The affected customers were in the UK and Germany. 

The intrusion occurred at CEVA Logistics rather than Pokémon Center itself. Reporting indicates attackers accessed CEVA systems between late July and August 1, disrupting operations at eight European warehouses and affecting multiple retailers. Valve previously notified European Steam hardware customers that their information had also been exposed through the CEVA incident. 

Why Does Shipping Data Matter to Scammers? 

A name and email address may not seem as sensitive as a credit-card number. But when criminals also know your address, phone number, and what you recently bought, they have something valuable: context. 

Context helps scammers make phishing messages believable. 

Phishing is when a criminal pretends to be a trusted company or person to persuade you to click a malicious link, hand over a password, share personal information, or send money. 

After a breach like this, criminals could potentially impersonate Pokémon Center, a delivery company, or another retailer and reference details that make their message feel legitimate. 

They might claim an order needs to be rescheduled, a delivery fee must be paid, or a refund is waiting. Knowing that you really placed an order can make the bait much harder to spot. 

Importantly, there is currently no evidence that the stolen Pokémon Center information is being used in such a campaign. But personalized phishing is a common reason breached contact and transaction information deserves attention. 

Key Takeaways 

Pokémon Center says the breach occurred at its logistics provider, CEVA, not its own shopping platform. 

  Names, addresses, phone numbers, email addresses, and order details may have been exposed. 

  Pokémon Center says payment-card information was not available to CEVA. 

  Real order details could make future phishing or delivery scams appear more credible. 

  Customers should independently verify unexpected messages about refunds, cancellations, or deliveries. 

3 Easy Safety Actions to Take If Your Information Is Exposed in a Data Breach 

Getting a breach notification doesn’t necessarily mean someone has already misused your information. It does mean you should take a few steps to make that information harder to use against you. 

1) Find out exactly what was exposed. Read the company’s breach notice carefully. An exposed email address calls for different precautions than a stolen password, Social Security number, financial information, or medical record.

2) Secure the accounts that could be at risk. Change any exposed or reused passwords, use a unique password for every account, and turn on multi-factor authentication where it’s available. If sensitive financial or identity information was stolen, consider a credit freeze or fraud alert as well.

3) Be extra skeptical of messages that know something about you. Breached information can help scammers create convincing emails, texts, and calls. A message that knows your name, address, recent purchase, or other real details isn’t necessarily legitimate. Go directly to the company’s website or app to verify unexpected requests rather than clicking a link or calling a number in the message.  

How McAfee Protects Against Breaches 

Before a breach  

Personal Data Cleanup reduces your digital footprint by removing your personal information from many data broker sites, making it harder for scammers to find and target you.  

Online Account Cleanup scans for accounts you no longer use and helps you delete them, along with your personal info.  

During a breach  

Identity Monitoring watches for your personal information, including email addresses, driver’s license numbers, passport numbers, bank accounts, credit cards, Social Security numbers, phone numbers, and more, across the dark web and known data leaks.   

Plus, we alert users on average up to 10 months earlier than similar services, so you can act fast when your personal information appears where it shouldn’t.  

After a breach  

Scam Detector identifies suspicious texts, emails, and links that often follow major breaches, while web protection blocks malicious websites designed to steal even more of your information. 

Other Scam and Security News This Week 

FBI warns about callers impersonating federal agents. The FBI’s Boston Division is warning about scammers who spoof its real phone number, pretend victims are connected to crimes, and then try to move conversations onto encrypted messaging apps. The key reminder: caller ID can be faked, and the FBI says it will not call private citizens to demand payment, threaten arrest, or request sensitive information. 

(Source: FBI Boston) 

CareCloud breach grows to more than 3.75 million patients. Healthcare technology company CareCloud has confirmed with federal regulators that hackers stole personal and medical information belonging to more than 3.75 million people, including Social Security numbers, health information, government-issued ID numbers, and some financial data. Because medical and identity information cannot simply be replaced like a password, affected people should take breach notifications particularly seriously. 

(Source: TechCrunch) 

Hacker claims millions of corporate directory records were stolen. A cybercriminal known as “TheHatman” is offering databases allegedly taken from the Microsoft Azure and Entra environments of several major companies, although some named organizations dispute that their current systems were breached and say portions of the information appear old. Even older employee information can still be useful for impersonation and targeted phishing, so the claims are worth watching without treating every advertised dataset as independently confirmed. 

(Source: TechRadar) 

This Week’s Safety Tips 

✓ Treat unexpected delivery messages with caution. Open the retailer or carrier’s official app or website instead of following a link in a text or email. 

✓ Don’t trust caller ID alone. Scammers can spoof a legitimate organization’s real phone number. 

✓ Use unique passwords and multi-factor authentication. Stolen personal information becomes more dangerous when criminals can also get into your accounts. 

✓ Pay attention to breach notices. Knowing exactly what information was exposed helps you recognize the scams criminals may try next. 

And we’ll be back next week with more cybersecurity news and scam alerts. 

The post Pokémon Center Breach Shows Why Your Delivery Data Matters: This Week in Scams appeared first on McAfee Blog.

One of the best ways to lower your AWS bill by 99 percent or more is by not checking your keys into public GitHub repositories. Many of us have done this inadvertently over the years, and the defenses against it have improved dramatically (my personal favorite being "using non-ephemeral credentials derived from OIDC or SSO is an anti-pattern"), but it still happens. On Friday, BleepingComputer reported on a Truffle Security finding that hundreds of leaked AWS keys are root keys and are somehow still active and valid. AWS Security is full of very smart people who care deeply about a number of things, including "not abetting crime." If they detect (usually via automated means) that a credential has been leaked, they're quick to apply a Quarantine Policy to it. Trouble is, that policy enumerates a bunch of bad behaviors in an ever-expanding graph of principals and associated behaviors. AWS' considered position on this is that they don't want to break customer environments: "The policy aims to limit the potential damage that may be caused by fraud-related activity leading to unauthorized charges, while not impacting the existing resources." AWS' considered position on this is wrong. If I get access to your credentials (much less a root credential, good god), deactivating them may very well break your workload because anything that relies on those credentials will start failing. Until you rotate them, those workloads will continue to fail. That's not good! But I promise you, as a bad actor, I can do far worse to you. Hold my tea Go ahead and apply a quarantine policy to a credential set and toss it my way. I won't be able to buy savings plans, read your S3 data, modify Lambda functions, and do a host of other things. But here's what I can do. Anything I damn well feel like on RDS. You don't have anything important in databases, right? ssm:SendCommand / ssm:StartSession are permitted, which means I can run commands as root on EC2 instances, which will in turn invoke with that instance role’s permissions. sts:AssumeRole means that I can assume any other role in the account and get its permissions, rendering the entire restriction list potentially moot. I can use autoscaling:CreateAutoScalingGroup / UpdateAutoScalingGroup to launch instances via the Auto Scaling service-linked role, so the ec2:RunInstances deny never applies. cloudtrail:LookupEvents gets denied (that'll stop you from... reading the audit log), but I can call both cloudtrail:StopLogging and DeleteTrail which do exactly what you expect; you don't have an audit log anymore. SES denies ses:GetSendQuota / ListIdentities actions, but y'know what's missing? SendEmail, so I can blast my spam out to your entire list. sns:GetSMSAttributes means I can't get your SMS configuration, but I can absolutely sns:Publish to send fraudulent text messages wherever I'd like. s3:DeleteObject gets denied, but s3:PutObject is allowed. I can't delete your data, but I can fill a bucket to petabytes. Next, they fail to block s3:PutBucketVersioning, s3:PutObjectLockConfiguration, s3:PutObjectRetention, and s3:PutObjectLegalHold. So on any existing bucket, like that one I just stuffed petabytes into, I can enable versioning, turn on Object Lock, and set a bucket-default COMPLIANCE-mode retention out to 2126, or alternatively slap it on per object. COMPLIANCE retention can't be shortened or removed by anyone, including the account root and AWS Support. The only way to remove it is to delete the entire AWS account. secretsmanager:GetSecretValue, ssm:GetParameter* (WithDecryption), and kms:Decrypt are all unencumbered, so your secrets are now my secrets. Sharing is good! Backups are important, so it's a shame you don't have any. Well, not after I kick off backup:DeleteRecoveryPoint / DeleteBackupVault, and rds:DeleteDBSnapshot. If you're using CloudFormation, and for some things you almost certainly are, cloudformation:DeleteStack going unmentioned means you're not using it anymore and all of your stacks are gone. I would make different choices This isn't a comprehensive list - just a few things that occurred to me over the course of about an hour. I'm not a bad actor; I'm almost positive that I'm missing a whole bunch. AWS is almost certainly going to change this. My question for them is simply, "how big of a customer incident needs to happen before you do?" ®

Hackers slipped malware into several popular Rust packages this week, turning routine software builds into a route onto developers' machines. The Rust Security Response Team disclosed the supply chain attack on Thursday after receiving a tip about a crate called proc-macro1. An investigation found that its build script fetched malware from a remote server. The attack extended beyond a single dodgy crate. Someone had published a new version of arrayref, a legitimate and widely used Rust package, with proc-macro1 added as a dependency. The attacker had also yanked recent legitimate releases of arrayref, helping steer users toward the poisoned release. The Rust team does not believe arrayref's maintainer was responsible. It suspects the developer's computer or credentials were compromised and locked the account while attempting to contact them. The attacker also published malicious versions of two other crates maintained by the same developer, internment and append-only-vec. The poisoned releases weren't around for long. Arrayref 0.3.10 was available on crates.io for 86 minutes, internment 0.8.7 for 90 minutes, and append-only-vec 0.1.9 for 107 minutes before they were removed. That's a narrow window, but arrayref is hardly some forgotten package gathering dust in the registry. Security firm Aikido, which separately analyzed the attack, puts arrayref at roughly 245 million lifetime downloads and append-only-vec at more than 4 million. However, those figures don't tell us how many developers pulled the malicious versions during the brief period they were live. Aikido found that the attacker largely left the legitimate source code untouched, adding only a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 package. The malicious code was tucked inside proc-macro1's build.rs file. Cargo, Rust's package manager, runs build scripts during compilation. This allowed proc-macro1 to identify the operating system and processor architecture of the developer or build machine, download a matching payload, and execute it. Aikido found malware built for Linux, Windows, Intel Macs, and Apple Silicon Macs. The second-stage payload was more than a simple downloader. Aikido found code targeting Chromium-based browser data, including profiles for Google Chrome, Brave, and Microsoft Edge, as well as browser extension storage used by cryptocurrency wallets. It also found functionality to establish persistence and receive commands from the attacker's server. The Rust team also deleted proc-macro-en, aovine, arone, aronenao, and tinymember, warning that every version of those crates should be considered malicious. Developers have been urged to check their Cargo lockfiles and local registry caches for the affected packages. Rust credits Nextron Systems' research team with initially discovering and reporting the attack. It has not said how the legitimate maintainer was compromised, how many developers downloaded the poisoned releases, or how many systems ultimately executed the payload. The malicious packages may have lasted less than two hours on crates.io, but whoever was behind them chose a well-traveled route into developers' machines. ®

Cisco has revealed its Secure Workload Software, a micro-segmentation tool formerly known as Tetration that is supposed to stop attackers moving laterally across a network, has four critical flaws plus another high-severity bug. CVE-2026-20315 and CVE-2026-20317 are the two perfect-ten-rated bugs. Both relate to improper access control. Cisco has not offered much detail about either, saying only that 20315 “covers authorization, authentication, privileges, and bypasses” and that 20317 has to do with “missing authentication, authentication bypass, and reliance on untrusted inputs.” The 9.9-rated flaw is CVE-2026-20231, which describes issues related to “Improper neutralization of special elements (covers command, OS, argument injection).” CVE-2026-20318 is the 9.6-er and is an improper input validation problem. Coming in last, at 7.5, is CVE-2026-20319, a problem related to “Improper restriction of operations within the bounds of a memory buffer” including overflows and out-of-bounds writes. Cisco offers Secure Workload Software as a SaaS-y service and for on-prem deployment. The company has fixed the flaws with its SaaS, but users still need to upgrade the Agent and Connector tools needed to use the cloudy software. On-prem users who have deployed version 3.10 or earlier need to get to version 3.10.9.1. Users of version 4.0 or later need to adopt 4.0.4.16 sooner rather than later. Cisco revealed the flaws on Thursday and says it discovered them after “a comprehensive internal security review” that involved “existing testing processes as well as frontier AI models.” Cisco is a known participant in Project Glasswing, which grants access to Anthropic’s too-powerful-for-public-release Mythos bug-finding model. So maybe that’s the frontier model involved in this research. Thankfully, Cisco says it has detected no malicious use of the vulnerabilities. ®

This week on “Uncanny Valley,” Andy Greenberg discusses sitting in on a war game simulating a cyberattack from the Chinese hacking group Volt Typhoon

Authored by Aayush Tyagi 

What McAfee Labs found 

McAfee Labs’ latest investigation into the WeedHack malware campaign found that the threat has continued to evolve even after its original command-and-control infrastructure was disrupted by McAfee. Researchers identified multiple active websites still distributing WeedHack to gamers, often by impersonating legitimate Minecraft clients, offering paid tools for free, or using trusted platforms to make malicious downloads appear credible. 

Among the findings: 

→ More than 6,300 attempts to access malicious sites were blocked by McAfee WebAdvisor in the past month. 

→ Researchers found lookalike gaming websites designed to closely replicate legitimate projects, including their branding, feature lists, FAQs, installation guides, developer credits, and links to genuine GitHub repositories. 

→ In one case, the top two Google results observed by researchers for a popular Minecraft client led to sites distributing WeedHack, demonstrating how SEO poisoning can put malicious downloads directly in gamers’ paths. 

→ Nearly half of the malicious URLs identified were Discord links (49.6%), followed by MediaFire (23.4%) and GitHub (8.2%), showing how attackers can use familiar platforms alongside fake websites to distribute malware. 

→ Researchers also identified a malicious site built using an AI-powered website creation platform, illustrating how readily available tools can make it easier to launch convincing new malicious sites. 

Threats like these show why protection needs to start before a malicious download ever reaches your device. McAfee helps block dangerous websites and downloads before malware has a chance to install, helping you stay focused on the game. 

Threats like these show why protection needs to start before a malicious download ever reaches your device. McAfee helps block dangerous websites and downloads before malware has a chance to install, helping you stay focused on the game. 

Background 

2026 has seen a significant shift in malware tactics, where traditional perimeter breaching techniques are being traded in for more elusive methods, such as AI-powered phishing and widespread deployment of Info-stealer malware. Over 560,000 new malware variants are detected every day, with infostealers accounting for the most active category.

McAfee Labs has also seen a significant spike in Malware-as-a-service (MaaS) campaigns, that offer their customers access to sophisticated infostealers and backdoor malware samples at minimal cost. These campaigns provide detailed tutorials to their customers, teaching them how to target popular gaming software, develop authentic-looking websites, and implement SEO Poisoning techniques in order to bamboozle gamers and infect their systems. 

Introduction 

Recently, McAfee Labs has covered a Malware-as-a-service campaign, called ‘Weedhack’ that infected over 116,464 gamers and utilized SEO Poisoning techniques to infect such a large user base.

Read the original article here: Game Over: WeedHack – The Rise of Minecraft Malware-as-a-Service Campaigns

While uncovering the depths of this campaign, we’ve encountered multiple websites and file hosting services that are still active and distributing WeedHack malware. In this article, we cover some of the most prominent examples we’ve encountered in the wild to educate our readers and provide key insights on how to identify and avoid such malicious websites.  

Note: This list is not exhaustive, and there may be additional websites that are not covered in this article.

Malicious websites spreading WeedHack 

During our investigation of this campaign, we observed that most of these websites appear legitimate, as they are well-crafted and often mimic legitimate websites. We observed a series of dedicated brand-impersonation attacks targeting several popular Minecraft clients. 

We published the original article in the first week of July, and, as a result, we’ve seen a disruption in WeedHack’s campaign: its C2 server is no longer active. Consequently, we have observed a shift in tactics by these attackers.  

The WeedHack Dashboard has been taken down, yet we’ve discovered websites that are actively spreading WeedHack malware.  

Out of these URLs, most belonged to file-hosting services:  

• 49.6% were Discord links 
• 23.4% were MediaFire links, 
• 8.2% were GitHub links 
• 4.6% were Dropbox links 

The remaining URLs were customer-facing websites designed to deceive users. 

In the last month, McAfee WebAdvisor has prevented more than 6,300 users from accessing these malicious websites. At the time of writing this blog, the following websites were still distributing WeedHack malware.  

 

This website ‘glazed-client.com’ replicates the original website called ‘glazedclient.com’. It provides a free and open-source Minecraft add-on called ‘Glazed Client’ designed specifically for DonutSMP server.  
 
The website contains a feature list, along with Archive, Credits, and FAQ sections, that are identical to those on the original website. 

Under the download section, the website provides three download options, and all of them are infected with WeedHack.  

This website has a GitHub link, which links to a legitimate GitHub repository in order to build trust with the visitors.  

Example 2 – radium-client.com 

 

The website ‘radium-client.com’ is replicating a legitimate website called ‘radiumclient.com’. The original website offers Minecraft client for $9.99 per month, but the malicious website offers the same tool for free.  

The malicious replica also has a detailed feature and download section. The downloaded JAR file is infected with WeedHack.  

In this instance, the malicious website contains a discord link, similar to the original website, but it points to a channel called ‘EasyClients’, that has over 1,900 members.  

This channel offers 7 different DonutSMP clients for free (Image 7, Highlighted in Red) which are also infected with WeedHack.  

Example 3 – seedcrackerx.github.io 

In this example, we see GitHub’s web hosting service ‘GitHub.io’ being exploited by attackers. Here they are impersonating ‘SeedCrackerX’ tool, which is a Minecraft seed cracking software capable of identifying the exact world seed used to generate a Minecraft world.  

Here, the malicious websites imitate the original website ‘seedcrackerx.com’, by replicating its fonts and color palette. The website also includes an elaborate tutorial and FAQ section, educating the visitors on how to properly install the tool. 

Under the download section, the website offers seven versions to choose from, but all of them are infected with WeedHack. (Highlighted in Red) 

This malicious website has also linked the genuine GitHub repository hosting the SeedCrackerX tool (Highlighted in Green), to appear more legitimate.  

Example 4 – xenoclient.lol and xenonclient.com 

Xenon Client is one of the most popular Minecraft Clients, known for being lightweight, community driven and offering niche vanilla-friendly utilities. Given its widespread popularity, this client is a prominent target for threat actors.

 

During our research, we identified that the top two Google search results for ‘Xenon Client’ directed users to websites (Highlighted in Red) that are spreading WeedHack.  

The “xenoclient.lol” website is particularly noteworthy, for the range of features and support it offers. The website includes comprehensive download and installation guides, as well as FAQ and Credits sections. Additionally, it lists the original Xenon Client GitHub repository and features a community section for like-minded gamers, further enhancing its professional appearance. 

It offers 2 purchase options for free and premium, where the premium version is listed for $5.  

The free option, on the other hand, offers six download options for the main client and six additional options for the client optimizer. At the time of writing, only one download link remains operational (highlighted in red), and it delivers a payload infected with WeedHack. 

Another website, “xenonclient.com,” is also targeting Minecraft players, luring them with a free version of the same client. 

Similar to other websites in the campaign, this site includes an installation guide and a feature list for the Xenon Client to enhance its apparent legitimacy.  

The final JAR file downloaded from this website infects users with WeedHack. 

Example 5 – nova-client.com 

Nova client is an open-source client designed for Minecraft Bedrock Edition.

 

This client is an easy target for attackers because it lacks an official website. The legitimate client is hosted on GitHub and Modrinth; however, attackers have created a spoofed website and leveraged SEO poisoning techniques to outrank the official sources in search results.  

This website also includes a Features page, installation guide, and FAQ section. In addition, it displays screenshots from the legitimate Nova Client to deceive users. 
 
What is interesting here is that attackers have also included a credits section, which is common with legitimate Minecraft client websites. However, they do not mention anyone who has actually worked on the project and instead used generic team names.  

The download section provides Nova Client for Minecraft 1.21.11, but the download file spreads WeedHack malware. 

Example 6 –  cheatlib.xyz 

CheatLib advertises that their clients have been downloaded over 1.6 million times, are free from malware and offers round-the-clock support.

 Similar to other such websites, it also features a setup guide and a FAQ section to address common user issues. 

They provide eight Minecraft Mods and inform users which Minecraft servers and anti-cheat systems they can bypass, as well as the current status of each mod.  

Although the website offers eight distinct mods, all eight files share the same hash and distribute the WeedHack payload. 

This website also links to a Discord channel called ‘CheatLib’ with over 220 users, which also provides access to WeedHack infected mods. 

Example 7 – meteorclients.com 

This malicious domain ‘meteorclients.com’ is impersonating a legitimate website ‘meteorclient.com’. They claim that this client has been downloaded over 10 million times and has over 15 thousand active users at any given time.  

The Team section contains the names of the legitimate Meteor Client developers, which appear to have been copied from the project’s official website, to create an appearance of authenticity.  

They also provide an interactive preview of Meteor client on the website, enabling users to test and familiarize themselves with the client. The website offers a single download option, which is infected with WeedHack. 

Example 8 – 22qq-client.com 

22qq-client is a Minecraft Mod for Crystal PVP servers.

This mod does not have a dedicated website, and attackers are exploiting this issue. This website is meant to serve as the official page for the client. 

The attackers attempt to establish credibility by using screenshots from the legitimate client.  

They also offer an interactive preview of the client to give users an overview of its functionality. This website provides multiple download buttons, but all of them download the same JAR file, which is infected with WeedHack. 

Example 9 – kryptonclientcrack.lovable.app 

Krypton Client is a paid Minecraft tool for DonutSMP server, hosted on ‘kryptonclient.org’. This malicious counterpart claims to offer a cracked version of the tool.  

The attackers have used an AI-powered tool called ‘lovable.app’ that allows customers to build and launch functional web applications and websites, using natural language. Such tools make it easier for attackers to deploy new malicious domains on the fly.  

The website claims that the tool has been downloaded more than five thousand times and has been thoroughly tested for safety. They offer a single download option, which is infected with WeedHack. 

Example 10 – File Hosting Services  

In the course of our investigation, we observed that multiple attackers were exploiting various file hosting services to spread malware. 

Links to these websites are then distributed via different communication channels, such as Discord, Reddit and other online platforms. 

We also observed that threat actors extended their targeting beyond Minecraft clients, compromising various popular and independent community websites within the Minecraft ecosystem.

At the time of this analysis, the following Planet Minecart links were spreading WeedHack malware. 

hxxps://static.planetminecraft.com/files/resource_media/mod/mousetweaks-fabric-mc1-21-9-2-29.jar 

hxxps://static.planetminecraft.com/files/resource_media/mod/no-delay-optimizer1-21-4.jar 

Similarly, we observed another community website, called EndMods was also targeted by WeedHack.

The following link is still active, at the time of publication, and is still spreading the WeedHack malware.  
hxxps://endmods.com/wp-content/uploads/2026/02/KRYPTON-CLIENT1.0.zip 

How To Protect Yourself Online 

At McAfee Labs, we investigate threats across the digital landscape, and gamers are a frequent target. We’ve seen multiple malware-as-a-service campaigns similar to WeedHack use fake downloads, impersonated websites, malicious mods, and other lures to target gaming communities. 

AI-powered tools can make it faster and easier for scammers to create convincing websites, imitate legitimate services, and launch new campaigns at scale. That makes it even more important to know what you’re downloading, and where it’s coming from. 

Here are a few ways gamers can stay safer: 

→ Stick to trusted sources. Download games, mods, clients, and other files from official developer websites or reputable mod platforms whenever possible. If you can’t verify the source, don’t download it. 

→ Never turn off your security software for a download. Be suspicious of any mod, cheat, or client that tells you to disable your antivirus or other protections before installing it. 

→ Scan files before opening them. Check downloaded mods, installers, and archives before running them — even if they came from a popular gaming community or website. 

→ Be skeptical of offers that seem too good to be true. “Free” premium features, exclusive cheats, cracked software, or paid clients can be used as bait to convince gamers to download malware. 

→ Check the URL before you download. Scammers can create lookalike domains and convincing copies of legitimate gaming sites. Small changes in a web address can be a sign you’re on an impersonation site. 

→ Pay attention to security warnings. If your antivirus flags a download, don’t automatically assume it’s a false positive. Stop and investigate before allowing the file to run. 

→ Keep your devices and software updated. Install updates for your operating system, browser, games, and security software to help protect against known vulnerabilities. 

Indicator of Compromise(s)  

hxxps://glazed-client.com/

hxxps://github.com/Hl3n/GambleRigMod

hxxps://www.radium-client.com/

hxxps://discord.com/channels/1467145812906872834/

hxxps://seedcrackerx.github.io/

hxxps://github.com/seedcrackerx/seedcrackerx.github.io

hxxps://xenonclient.com/

hxxps://xenoclient.lol

hxxps://nova-client.com/

hxxps://cheatlib.xyz/

hxxps://discord.com/channels/1478170973755936990

hxxps://meteorclients.com

hxxp://22qq-client.com/

hxxps://kryptonclientcrack.lovable.app

hxxps://github.com/lsellh/

hxxps://static.planetminecraft.com/files/resource_media/mod/mousetweaks-fabric-mc1-21-9-2-29.jar

hxxps://static.planetminecraft.com/files/resource_media/mod/no-delay-optimizer1-21-4.jar

hxxps://endmods.com/wp-content/uploads/2026/02/KRYPTON-CLIENT1.0.zip

 

The post WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware appeared first on McAfee Blog.

The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed.

Flock’s surveillance cameras have already sparked outrage. WIRED reconstructed its next-generation AI system, already in use by some police, to confirm it goes much further than tracking license plates.

The ChatGPT maker says its upcoming Astra model may have reached “critical” cyber capabilities, prompting it to halt a significant number of training runs while it tightens internal safeguards.

One advertisement featured a pornographic video with a deepfake closely resembling a prominent US politician. Apple removed the app from the App Store after an inquiry from WIRED.

Proton’s CEO is a champion of encryption for everyone. So why is he going all in on un-encryptable AI?

After Noel Pichardo called out his city's embrace of Flock surveillance cameras, he was subjected to five internal affairs investigations in less than two years.

Quishing has become a popular alternative to traditional phishing. Here’s how businesses can close the gap.

An AI analyst that triages, investigates, and verifies attacks at machine speed — and where it meets the Cisco Data Fabric.

At a press conference outside Madison Square Garden, politicians, musicians, and privacy advocates argued for tighter restrictions on how public venues deploy biometric surveillance.

This week in scams and cybersecurity news, 

Looking for a free download of this summer’s biggest movie could come with something you definitely didn’t ask for: malware. 

Here’s what to watch for. 

Fake The Odyssey Downloads Are Hiding Malware 

Speaking of Trojan horses….

Security researchers have reportedly identified malicious downloads disguised as pirated copies of The Odyssey, including files designed to look like high-quality movie releases. 

Some fake files even use familiar video-player icons and movie-style filenames to appear legitimate.

But instead of opening a movie, downloading or running the file can launch malicious software capable of stealing information from the device. Other scams reportedly use fake streaming sites that ask users to enter personal or payment information to access a supposedly “free” movie.  

McAfee researchers routinely see cybercriminals attach malware to the things people are already searching for, especially popular movies, TV shows, games, mods, and software. 

In a recent example, McAfee Labs uncovered the WeedHack malware campaign targeting Minecraft players, which disguised malicious software as free game mods and clients. Our researchers recorded more than 116,000 infections from the campaign since January. 

The media changes. The scam doesn’t.

What Makes Fake Movie Downloads Dangerous? 

A supposed movie file can hide: 

• Infostealers designed to collect passwords, browser sessions, payment information, or cryptocurrency data 
• Trojans that give an attacker access to your device 
• Loaders that install additional malware 
• Fake browser updates or extensions that redirect you to scams or malicious websites 

One especially obvious warning sign: movies should not arrive as executable .exe files. Legitimate video files generally use formats such as .mp4, .mkv, or .avi. 

When in doubt, don’t download it. 

How McAfee Protects Against Malware

With McAfee+, multiple layers can help protect you when a tempting download isn’t what it claims to be: 

Device Security helps detect malicious apps, files, and downloads before they can compromise your device. 

Web Protection helps block risky websites, including malicious download pages, even if you accidentally click. 

Scam Detector flags suspicious texts, emails, links, QR codes, and other messages that may try to direct you toward fraudulent sites. 

Identity Monitoring alerts you if your personal information appears in known data leaks or on the dark web so you can take action quickly. 

Together, these protections help address both sides of fake-download scams: stopping malware before it gets onto your device and helping protect your information if criminals try to steal it. 

Other Scam and Security News This Week 

Here are some other breaches, scams, and cybersecurity headlines making waves this week:

Trezor breach reportedly exposes information belonging to nearly 14,000 crypto customers.

Hardware wallet maker Trezor says a breach involving one of its shipping providers exposed personal information including names, email addresses, phone numbers, and home addresses for thousands of customers.  

McAfee’s 2026 State of the Scamiverse predicted that crypto and financial scams were likely to intensify this year, and cryptocurrency-related messages remain among the scams McAfee Scam Detector regularly identifies and blocks.

(Financial Times) 

Cyberattacks continue to climb worldwide.

New threat research found organizations experienced an average of 2,336 cyberattacks per week in July, a 16% increase from the previous year, while reported ransomware victims also rose sharply. Education, government, telecommunications, and other major sectors remained frequent targets.

(IT Brief) 

Android malware can turn a victim’s phone into part of a contactless-payment scam.

Researchers investigating the targeted WindRelay campaign say criminals impersonated banks over the phone, persuaded victims to install malicious Android apps, and then instructed them to tap their physical bank cards against their phones. 

That allowed attackers to relay contactless card information in real time, with researchers reporting some attacks unfolded during calls lasting only about 13 minutes.

(TechRadar) 

This Week’s Safety Tips 

✓ Stream and download from legitimate sources. New theatrical releases appearing for free on unfamiliar websites should immediately raise suspicion. 

✓ Check the actual file type before opening a download. A movie should never require you to run an .exe application. 

✓ Never install a “special player,” browser update, or extension just to watch a movie. Close the page and go directly to a trusted streaming service instead. 

✓ Treat urgency and exclusivity as warning signs. “Watch it before everyone else,” “leaked copy,” and “limited access” are designed to get you clicking before you think. 

And we’ll be back next week with more cybersecurity news and scam alerts. 

The post Fake “The Odyssey” Downloads Are Spreading Malware: This Week in Scams appeared first on McAfee Blog.

And will today’s surge in AI-driven vulnerability discovery eventually make tomorrow’s software safer?

The incident involving OpenAI models shows that autonomous hacks make human oversight more important, not less

Records obtained by WIRED detail hundreds of allegations of Customs and Border Protection workers misusing internal tools to look up romantic interests and track colleagues’ cell phones.

AI took center stage, but the clearest lesson was less about what AI can do than about who is accountable when something goes wrong