Marsalek Malware Distributed via Fake Game Cheats Targets Passwords and Crypto
The Marsalek information stealer, operating as a malware-as-a-service, is being distributed through fake cheats for popular games like Roblox and Fortnite, targeting Windows users to steal credentials and cryptocurrency.
Cybercriminals are actively distributing a potent information stealer known as Marsalek by embedding it within counterfeit cheats and tools for popular video games such as Roblox, Fortnite, and Counter-Strike 2. These deceptive files, masquerading as helpful game enhancements, secretly exfiltrate sensitive data from Windows PCs, including saved passwords, browser cookies, Discord tokens, and cryptocurrency wallet information.
Marsalek operated as a malware-as-a-service (MaaS) from approximately December 2025 to May 2026, allowing anyone to subscribe to a public platform, generate malicious files, and monitor their victims via a dedicated dashboard. Notably, the free tier of this service did not even require users to provide a Discord or email account, lowering the barrier to entry for aspiring threat actors. This tactic of distributing malware through fake game cheats has become increasingly popular, with similar campaigns observed pushing other stealers via platforms like GitHub and Reddit.
Security researchers at McAfee Labs identified Marsalek and cataloged a significant operation, noting over 1,560 registered accounts, more than 400 malicious files created, and over 29 distinct distribution URLs. The analysis also revealed a connection between Marsalek and WeedHack, a service focused on Minecraft, due to both services directing customers to the same Telegram support channel, @MetaMaskenMann.
The lures employed by Marsalek operators closely mimic tools that gamers actively search for. McAfee observed fake versions of popular Roblox script executors like Swift, Solara, MatrixHub External, and Matcha External. Additionally, fake Minecraft clients such as Shadow Client and Boss Client, along with a file named Fortnite_tweaks.exe, were identified. These malicious files are disseminated through look-alike websites, Discord servers, and GitHub repositories.
Infection chains can be initiated through various means, including PowerShell scripts, "ClickFix" pages, Python files, or executable files. Once initiated, the process often involves downloading a portable Python package and a secondary file, python_setup.py. This script attempts to elevate privileges using the Windows CMSTP tool, surreptitiously bypasses the user's permission prompt, and then adds numerous paths and processes to Microsoft Defender's exclusion list to evade detection.
The core stealing functionality is handled by a file named svc.py, which contains over 1,400 lines of code. It targets 32 Chromium-based browsers and Firefox, employing sophisticated techniques to bypass Chrome's App-Bound Encryption by injecting a DLL into suspended browser processes. The malware also targets 26 Discord paths, exfiltrates Telegram session data, and reads Mullvad VPN account details. Furthermore, it scans for 26 browser extensions and 12 wallet applications, actively searching for files containing keywords like "seed," "passphrase," and "wallet."
The final stage involves PureLog, a low-cost stealer sold for as little as $59 per month. This component is obfuscated using .NET Reactor, decrypted with Triple DES, and executed purely in memory. It targets an extensive list of 35 browsers, 48 extensions, and 12 desktop applications, captures screenshots, and establishes a scheduled task to maintain persistence. Data is exfiltrated to a separate server at telemetrydata.to. A critical aspect of Marsalek's design is its "dual hook" mechanism: while customers believe they control the stolen logs, the malware's author also receives a copy and may prioritize the use of high-value victim accounts.
McAfee observed the highest concentration of Marsalek activity in the United States, followed by Germany, the United Kingdom, India, and Brazil. The prevalence of gaming profiles as valuable targets underscores the attackers' motivation to steal gaming accounts, sell in-game items, or reuse credentials for other online services. To mitigate these threats, users are strongly advised to download games and tools exclusively from official sources, maintain active antivirus protection, and avoid pasting commands from untrusted web pages. Individuals who may have run suspicious cheat software should immediately change passwords from a clean device, sign out of all active sessions, transfer cryptocurrency to a new wallet, and consider reinstalling their operating system.