VULNpocalypse
HighEcosystem changeMonitoring

Marsalek infostealer hides in fake Roblox, Fortnite and Minecraft game cheats

Marsalek infostealer hid in fake Roblox, Fortnite and Minecraft cheats; if you ran one, rotate passwords and sessions from a clean device.

Published
Exploitation
Yes, McAfee observed infections, most in the United States, followed by Germany, the United Kingdom, India and Brazil

What happened

McAfee researchers documented Marsalek, a free malware-as-a-service (MaaS) platform. It disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft and Grim Dawn. GBHackers says it was active from mid-December 2025 to late May 2026. Cyber Security News gives the period as about December 2025 to May 2026 (GBHackers, Cyber Security News). Both outlets report McAfee’s counts: more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs.

Anyone could sign up, build a payload and track victims on a dashboard. The free tier did not require a Discord or email account (Cyber Security News). Marsalek is linked to WeedHack, a Minecraft-focused MaaS campaign McAfee documented in June 2026. Both use the same Telegram support handle, and Marsalek reuses WeedHack’s final-stage payloads but uses Python for its intermediate stages. GBHackers adds that in August 2026 McAfee reported that WeedHack sites were still active and spreading malware through SEO poisoning (GBHackers).

Lures and delivery. The files posed as Roblox executors such as Solara, Swift, MatrixHub External and Matcha External. They also posed as Minecraft clients such as Shadow Client and Boss Client. One sample was named Fortnite_tweaks.exe. They spread through look-alike websites, Discord and GitHub (Cyber Security News). Stage one could be a PowerShell script, a ClickFix fake CAPTCHA page, a Python script or an executable. Cyber Security News describes the ClickFix page as a fake Cloudflare check that tells victims to paste commands into Windows.

Infection chain, as reported by GBHackers and Cyber Security News:

  • Each vector downloads a portable Python runtime. It then runs python_setup.py, which escalates privileges through a CMSTP UAC bypass.
  • The script adds 8 exclusion paths and 15 exclusion processes to Microsoft Defender. GBHackers says it does this through a file named WinDefConfig.cmd.
  • Stage three, svc.py, is a stealer of roughly 1,400 lines. It targets 32 Chromium browsers, Firefox, 56 browser extensions and 12 desktop crypto wallets.
  • It also takes Discord tokens from 26 paths, Telegram session data and Mullvad VPN account details. It scans user folders for files matching keywords such as “seed”, “wallet” and “passphrase”.
  • It bypasses Chrome’s App-Bound Encryption on Chrome, Edge and Brave. It does this by injecting a DLL into a suspended browser process, so the browser’s Elevation Service decrypts the master key.
  • It replaces files in Exodus and Atomic Wallet with malicious .asar archives to create backdoors.
  • GBHackers reports persistence through the Startup folder and scheduled tasks.

Final stage. The last stage is PureLog Stealer, obfuscated with .NET Reactor and loaded in memory. GBHackers says it is decrypted with 3DES and GZIP, and Cyber Security News says Triple DES (GBHackers). Cyber Security News adds these details (Cyber Security News):

  • PureLog targets 35 browsers, 48 extensions and 12 desktop apps, and takes a screenshot.
  • It sets a scheduled task that runs RunetimeBroker.exe every five minutes.
  • It sends data to a separate server, telemetrydata[.]to.

Both outlets describe this as a dual hook: the Marsalek operator also receives the data that customers steal.

Am I affected?

You may be affected if you ran a game cheat, script executor, “tweaks” tool or modded client from an unofficial site, Discord or GitHub. This applies especially to Roblox, Fortnite, Minecraft or Counter-Strike 2 tools, and to any tool that asked you to disable antivirus or paste a command from a web page. The reported targets are Windows PCs (Cyber Security News). Many Marsalek customers appear to be teenagers (GBHackers).

Indicators reported by the sources:

  • Domains: marsalek[.]cy (main C2), telemetrydata[.]to and huehnchenfarm[.]ru (secondary C2) (Cyber Security News).
  • Stage one SHA256 hashes, as listed by both outlets:
    • Fake CAPTCHA page: c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97
    • build_1280.exe: 98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4
    • build_1505.exe: 29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb488c8add3f04ee087011
    • payload_1.ps1: ae975e468c26c67a2618d0da28d671c1101d01979a10677abe658a7b40f221be

The full hash and distribution URL list is in the Cyber Security News article.

Defenders can watch for these signs (GBHackers):

  • cmstp.exe launched with the /au flag
  • Bulk changes to Defender exclusions
  • Unexpected Python runtimes in user directories

What to do now

  1. From a clean device, change the passwords saved in any browser on the affected PC (Cyber Security News).
  2. Revoke active sessions and Discord tokens, and sign out of all sessions on your accounts (GBHackers).
  3. Move crypto to new wallets. Treat Exodus and Atomic Wallet installs on the PC as backdoored (GBHackers).
  4. Reinstall Windows on the affected machine, as Cyber Security News advises (Cyber Security News).
  5. Check Microsoft Defender’s exclusion list and scheduled tasks for entries you did not add (GBHackers).
  6. Going forward, download games and tools only from official sources. Do not run executables shared on Discord, never disable antivirus because a site tells you to, and never paste commands from a web page (GBHackers, Cyber Security News).

Sources