Marsalek stealer hidden in fake Roblox Fortnite cheats
Original title: Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data
AI summary · x-ai/grok-4.7Summaries by Vani AI
The malware-as-a-service stealer targets passwords, Discord tokens, and crypto wallets through fake game cheats and tools.
Hackers are distributing the Marsalek information stealer via fake cheats for Roblox, Fortnite, and Counter-Strike 2. The malware steals saved passwords, browser cookies, Discord tokens, and crypto wallet data. It operated as malware-as-a-service from December 2025 to May 2026 and has been linked to over 1,560 accounts and 400 files.
Key facts
- Targets Windows PCs via fake game executables
- Uses PowerShell, ClickFix, and CMSTP for initial access
- Steals from 32+ browsers and 26 Discord paths
- Dual-hook design copies data to author
- Defense: download from official sources only
Security assessment · AI, from the articleExploited in the wild
Impact: steal saved passwords, browser cookies, Discord tokens, and crypto wallet data
| Product | Affected |
|---|---|
| Microsoft Windows | — |
What to do
- 1.Download games and tools only from official sources
- 2.Never paste commands from a web page
- 3.Change passwords from a clean device after suspicious cheat
- Vendors
- McAfeeBitdefender
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | huehnchenfarm.ru | cy Secondary C2 domain telemetrydata.to Secondary C2 domain huehnchenfarm.ru Distribution URL hxxp://cdn.filepost.dev/file/filepost/uplo |
| ipv4 | 130.12.180.43 | eases/download/Release/Executor.rar Distribution URL hxxp://130.12.180.43/files/6749237131/MVvd2DP.exe Distribution URL hxxp://130.12 |
| md5 | adac14669df84170ae21e99e542ff7d3 | bution URL hxxp://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe Distribution URL hxxps://cdn.filepost.dev/file/filepost |
| sha256 | 04b0dbddaa7791445adbaf7c47fe388d4ddad724b2a6b55463d2a81cacf3339d | c1101d01979a10677abe658a7b40f221be Stage 1 ShadowClient.exe 04b0dbddaa7791445adbaf7c47fe388d4ddad724b2a6b55463d2a81cacf3339d Stage 1 Discord Free Nitro Gen.exe 075d2ad32039674a2c65d899 |
| sha256 | 075d2ad32039674a2c65d899ae6760adf2457fe6af93710d204cee69e318a858 | b2a6b55463d2a81cacf3339d Stage 1 Discord Free Nitro Gen.exe 075d2ad32039674a2c65d899ae6760adf2457fe6af93710d204cee69e318a858 Stage 1 build_1540.exe 0c6f22efc8212739358ee2ce3564ffd3d193 |
| sha256 | 091736aba514598513a936446a7776b1fa4585883bee38afb74cfe840176a8bc | 649af7e9e23daec19b45d19ed92f1877bc54acd9 Stage 2 payload.py 091736aba514598513a936446a7776b1fa4585883bee38afb74cfe840176a8bc Stage 2 python_setup.py 76d90ab4ba2be337e1ae03f69d12bfa8733 |
| sha256 | 0c6f22efc8212739358ee2ce3564ffd3d193a74c1197cfc90d6345e33655ddeb | 60adf2457fe6af93710d204cee69e318a858 Stage 1 build_1540.exe 0c6f22efc8212739358ee2ce3564ffd3d193a74c1197cfc90d6345e33655ddeb Stage 1 Fortnite_tweaks.exe 206e7a9a9cb0767d356de26d2f3b6fc |
| sha256 | 206e7a9a9cb0767d356de26d2f3b6fca85552c2d89104f343fc2e20a64e1efa4 | 193a74c1197cfc90d6345e33655ddeb Stage 1 Fortnite_tweaks.exe 206e7a9a9cb0767d356de26d2f3b6fca85552c2d89104f343fc2e20a64e1efa4 Stage 1 r.vbs 279b6b8621f61f63e1537f7225bef375fc497342a8129 |
| sha256 | 279b6b8621f61f63e1537f7225bef375fc497342a812904d8194b5a44df3efbe | de26d2f3b6fca85552c2d89104f343fc2e20a64e1efa4 Stage 1 r.vbs 279b6b8621f61f63e1537f7225bef375fc497342a812904d8194b5a44df3efbe Stage 1 CS2-TriggerBot-main/main.py fe510937483b1b79e9da1f1 |
| sha256 | 29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb488c8add3f04ee087011 | 428d230e535b5e775ed7cb4fc6dfd8397ab4 Stage 1 build_1505.exe 29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb488c8add3f04ee087011 Stage 1 payload_1.ps1 ae975e468c26c67a2618d0da28d671c1101d0 |
| sha256 | 2c1c38eb0c427ff5f2aaa3029cc4526f797676ee3ba154c6a980c39f9357e2df | f321a8df32b1e9e2a19da91784f5575ed0a625ead811 Stage 3 src.py 2c1c38eb0c427ff5f2aaa3029cc4526f797676ee3ba154c6a980c39f9357e2df Stage 3 chromedriver.dll c7691712d794d4ef582c591566bf5fda76 |
| sha256 | 3281e77e96bbd073ec8287928eadb2e47ba5337909800268bc9af0ee985def42 | 04ae4c4b95f2be50fce57c65ba7c0c16ff48193e84ae Stage 3 svc.py 3281e77e96bbd073ec8287928eadb2e47ba5337909800268bc9af0ee985def42 Stage 3 svc.py 7387b1ff5c2d4cdff9abcdb078742f26373e479f883b |
| sha256 | 4067e5f3dea8180dc47ea8c737b0cd2b11d4dfd5ef65f9e5ff30049eb8762f3e | fce21637c0ce7a5799259ee3d29e8364f1e Stage 2 python_setup.py 4067e5f3dea8180dc47ea8c737b0cd2b11d4dfd5ef65f9e5ff30049eb8762f3e Stage 2 downloaded_payload.txt b75cc775a8c1f91d38dab69a9b72 |
| sha256 | 4786f77b0db68586992f5e2f7f8961146ae3401cb3ae4edef52a69dce1392538 | 453822535136186560/net-nuker.exe?ex=69517c3f&is=69502abf&hm=4786f77b0db68586992f5e2f7f8961146ae3401cb3ae4edef52a69dce1392538& Distribution URL hxxps://cdn.discordapp.com/attachments/14 |
| sha256 | 4c997f6b315b450a4db6f7079966ff58203b7ef66023a36e97b4b1131d515ce7 | 911142895737/Fortnite_tweaks.exe?ex=69601368&is=695ec1e8&hm=4c997f6b315b450a4db6f7079966ff58203b7ef66023a36e97b4b1131d515ce7& Note: IP addresses and domains are intentionally Qdefanged |
| sha256 | 4d10ad22da0b18019744b491de4be40b31b336c4b42d4067e16e967bfc07e8f8 | 7/1475468285955932232/szatum.exe?ex=699ee9ec&is=699d986c&hm=4d10ad22da0b18019744b491de4be40b31b336c4b42d4067e16e967bfc07e8f8& Distribution URL hxxps://cdn.discordapp.com/attachments/68 |
| sha256 | 50afe3eaad628cce1300d9571049357f09ae70fae17a56231736c335eda276de | 5/1462929986381152378/netgen.exe?ex=696ffb38&is=696ea9b8&hm=50afe3eaad628cce1300d9571049357f09ae70fae17a56231736c335eda276de& Distribution URL hxxps://cdn.discordapp.com/attachments/14 |
| sha256 | 54ec316f639c97ec8b0cf321a8df32b1e9e2a19da91784f5575ed0a625ead811 | 5cda85897d901dfca9761c678b82781177ff13ec5923 Stage 3 svc.py 54ec316f639c97ec8b0cf321a8df32b1e9e2a19da91784f5575ed0a625ead811 Stage 3 src.py 2c1c38eb0c427ff5f2aaa3029cc4526f797676ee3ba1 |
| sha256 | 6d372f7c5fc686135fedbc1943d7b1eff339fbfd91d26a62f3dddca1c1b7a884 | 455720862660563037/net-nuker.exe?ex=699af7f3&is=6999a673&hm=6d372f7c5fc686135fedbc1943d7b1eff339fbfd91d26a62f3dddca1c1b7a884& Distribution URL hxxps://cdn.discordapp.com/attachments/14 |
| sha256 | 6fb6adb819a82bc9e7afdc83649af7e9e23daec19b45d19ed92f1877bc54acd9 | 9a9b7278b9ef7c84cf14435d374a6d7c2660e16c02 Stage 2 virus.py 6fb6adb819a82bc9e7afdc83649af7e9e23daec19b45d19ed92f1877bc54acd9 Stage 2 payload.py 091736aba514598513a936446a7776b1fa458588 |
| sha256 | 714267c512e8cfec6a535cda85897d901dfca9761c678b82781177ff13ec5923 | 6fd3cbec73a1c78df6988b742ae1d3a6458a82d135a7 Stage 3 svc.py 714267c512e8cfec6a535cda85897d901dfca9761c678b82781177ff13ec5923 Stage 3 svc.py 54ec316f639c97ec8b0cf321a8df32b1e9e2a19da917 |
| sha256 | 7387b1ff5c2d4cdff9abcdb078742f26373e479f883bdd472f1aff58969b4fb2 | 87928eadb2e47ba5337909800268bc9af0ee985def42 Stage 3 svc.py 7387b1ff5c2d4cdff9abcdb078742f26373e479f883bdd472f1aff58969b4fb2 Stage 3 svc.py c12ffe59220fff73cabe6fd3cbec73a1c78df6988b74 |
| sha256 | 76d90ab4ba2be337e1ae03f69d12bfa873357bd5a0f177274a95b66621139c59 | 6b1fa4585883bee38afb74cfe840176a8bc Stage 2 python_setup.py 76d90ab4ba2be337e1ae03f69d12bfa873357bd5a0f177274a95b66621139c59 Stage 2 AsyncRAT.py b28bbedac88d0b52531cf344f25ef95fe364e0f |
| sha256 | 80369b451d7f9b20ebe4893adab9f7530dead3493e895aad7727b0b29ff1e50c | 455720862660563037/net-nuker.exe?ex=695a5e73&is=69590cf3&hm=80369b451d7f9b20ebe4893adab9f7530dead3493e895aad7727b0b29ff1e50c& Distribution URL hxxps://cdn.discordapp.com/attachments/14 |
| sha256 | 9327a55cb9e76aab18c404ae4c4b95f2be50fce57c65ba7c0c16ff48193e84ae | 95fe364e0f3ff9e5105a119f379d83c6ebd Stage 2 python_setup.py 9327a55cb9e76aab18c404ae4c4b95f2be50fce57c65ba7c0c16ff48193e84ae Stage 3 svc.py 3281e77e96bbd073ec8287928eadb2e47ba533790980 |
| sha256 | 98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4 | 068c0cd6e3356343ca5ea3a916acdf6f3b97 Stage 1 build_1280.exe 98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4 Stage 1 build_1505.exe 29f65faa96c9743e9ea1242dcb9d8a4a453b |
| sha256 | 9cf8bab29514d62595e148eb588f0cbecefb947d572c06b4547cff7ea4231747 | 5fda76a364b0bcdad315adbaaec8607ad0f3 Stage 4 WinSvcHost.exe 9cf8bab29514d62595e148eb588f0cbecefb947d572c06b4547cff7ea4231747 Stage 4 Pdihj.exe e0866124208da639f6cde652d78a3d5e350ad99db |
| sha256 | 9e4ea8b578475f18e092da73e56c0054261a881180d93f0909135bd6bdb4845d | 3d5e350ad99dbd008aa48dbd1475af4e93ff Stage 4 Kvxefnlfro.exe 9e4ea8b578475f18e092da73e56c0054261a881180d93f0909135bd6bdb4845d Domains and distribution URLs Type Indicator Main C2 domain |
| sha256 | ae975e468c26c67a2618d0da28d671c1101d01979a10677abe658a7b40f221be | d8a4a453b778f7dfb488c8add3f04ee087011 Stage 1 payload_1.ps1 ae975e468c26c67a2618d0da28d671c1101d01979a10677abe658a7b40f221be Stage 1 ShadowClient.exe 04b0dbddaa7791445adbaf7c47fe388d4d |
| sha256 | b28bbedac88d0b52531cf344f25ef95fe364e0f3ff9e5105a119f379d83c6ebd | d12bfa873357bd5a0f177274a95b66621139c59 Stage 2 AsyncRAT.py b28bbedac88d0b52531cf344f25ef95fe364e0f3ff9e5105a119f379d83c6ebd Stage 2 python_setup.py 9327a55cb9e76aab18c404ae4c4b95f2be5 |
| sha256 | b75cc775a8c1f91d38dab69a9b7278b9ef7c84cf14435d374a6d7c2660e16c02 | dfd5ef65f9e5ff30049eb8762f3e Stage 2 downloaded_payload.txt b75cc775a8c1f91d38dab69a9b7278b9ef7c84cf14435d374a6d7c2660e16c02 Stage 2 virus.py 6fb6adb819a82bc9e7afdc83649af7e9e23daec19b |
| sha256 | c12ffe59220fff73cabe6fd3cbec73a1c78df6988b742ae1d3a6458a82d135a7 | cdb078742f26373e479f883bdd472f1aff58969b4fb2 Stage 3 svc.py c12ffe59220fff73cabe6fd3cbec73a1c78df6988b742ae1d3a6458a82d135a7 Stage 3 svc.py 714267c512e8cfec6a535cda85897d901dfca9761c67 |
| sha256 | c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97 | 256 hashes Stage File name SHA256 Stage 1 Fake CAPTCHA Page c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97 Stage 1 build_1280.exe 98f138624ea96313dd5803356dc9428d230e |
| sha256 | c7691712d794d4ef582c591566bf5fda76a364b0bcdad315adbaaec8607ad0f3 | 6f797676ee3ba154c6a980c39f9357e2df Stage 3 chromedriver.dll c7691712d794d4ef582c591566bf5fda76a364b0bcdad315adbaaec8607ad0f3 Stage 4 WinSvcHost.exe 9cf8bab29514d62595e148eb588f0cbecefb |
| sha256 | e0866124208da639f6cde652d78a3d5e350ad99dbd008aa48dbd1475af4e93ff | b588f0cbecefb947d572c06b4547cff7ea4231747 Stage 4 Pdihj.exe e0866124208da639f6cde652d78a3d5e350ad99dbd008aa48dbd1475af4e93ff Stage 4 Kvxefnlfro.exe 9e4ea8b578475f18e092da73e56c0054261a |
| sha256 | fe510937483b1b79e9da1f1a18bc7fce21637c0ce7a5799259ee3d29e8364f1e | 812904d8194b5a44df3efbe Stage 1 CS2-TriggerBot-main/main.py fe510937483b1b79e9da1f1a18bc7fce21637c0ce7a5799259ee3d29e8364f1e Stage 2 python_setup.py 4067e5f3dea8180dc47ea8c737b0cd2b11d |
| url | http://130.12.180.43/files/5532726588/cPr84lu.exe | 130.12.180.43/files/6749237131/MVvd2DP.exe Distribution URL hxxp://130.12.180.43/files/5532726588/cPr84lu.exe Distribution URL hxxps://cdn.discordapp.com/attachments/140 |
| url | http://130.12.180.43/files/6749237131/MVvd2DP.exe | tor/releases/download/Release/Executor.rar Distribution URL hxxp://130.12.180.43/files/6749237131/MVvd2DP.exe Distribution URL hxxp://130.12.180.43/files/5532726588/cPr8 |
| url | http://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe | ta.to Secondary C2 domain huehnchenfarm.ru Distribution URL hxxp://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe Distribution URL hxxps://cdn.filepost.dev/file/filepost/upl |
| url | http://github.com/FomaNory/Roblox-Script-Executor/releases/download/Release/Executor.rar | racked/raw/refs/heads/main/newuimatrix.exe Distribution URL hxxp://github.com/FomaNory/Roblox-Script-Executor/releases/download/Release/Executor.rar Distribution URL hxxp://130.12.180.43/files/6749237131/MVvd |
| url | https://cdn.discordapp.com/attachments/1406651955421384817/1453822535136186560/net-nuker.exe?ex=69517c3f&is=69502abf&hm=4786f77b0db68586992f5e2f7f8961146ae3401cb3ae4edef52a69dce1392538& | 130.12.180.43/files/5532726588/cPr84lu.exe Distribution URL hxxps://cdn.discordapp.com/attachments/1406651955421384817/1453822535136186560/net-nuker.exe?ex=69517c3f&is=69502abf&hm=4786f77b0db68586992f5e2f7f8961146ae3401cb3ae4edef52a69dce1392538& Distribution URL hxxps://cdn.discordapp.com/attachment |
| url | https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=695a5e73&is=69590cf3&hm=80369b451d7f9b20ebe4893adab9f7530dead3493e895aad7727b0b29ff1e50c& | f7f8961146ae3401cb3ae4edef52a69dce1392538& Distribution URL hxxps://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=695a5e73&is=69590cf3&hm=80369b451d7f9b20ebe4893adab9f7530dead3493e895aad7727b0b29ff1e50c& Distribution URL hxxps://cdn.discordapp.com/attachment |
| url | https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=699af7f3&is=6999a673&hm=6d372f7c5fc686135fedbc1943d7b1eff339fbfd91d26a62f3dddca1c1b7a884& | adab9f7530dead3493e895aad7727b0b29ff1e50c& Distribution URL hxxps://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=699af7f3&is=6999a673&hm=6d372f7c5fc686135fedbc1943d7b1eff339fbfd91d26a62f3dddca1c1b7a884& Distribution URL hxxps://cdn.discordapp.com/attachment |
| url | https://cdn.discordapp.com/attachments/1460394029215781075/1462929986381152378/netgen.exe?ex=696ffb38&is=696ea9b8&hm=50afe3eaad628cce1300d9571049357f09ae70fae17a56231736c335eda276de& | 943d7b1eff339fbfd91d26a62f3dddca1c1b7a884& Distribution URL hxxps://cdn.discordapp.com/attachments/1460394029215781075/1462929986381152378/netgen.exe?ex=696ffb38&is=696ea9b8&hm=50afe3eaad628cce1300d9571049357f09ae70fae17a56231736c335eda276de& Distribution URL hxxps://cdn.discordapp.com/attachments/1 |
| url | https://cdn.discordapp.com/attachments/1467511838848847997/1475468285955932232/szatum.exe?ex=699ee9ec&is=699d986c&hm=4d10ad22da0b18019744b491de4be40b31b336c4b42d4067e16e967bfc07e8f8& | 71049357f09ae70fae17a56231736c335eda276de& Distribution URL hxxps://cdn.discordapp.com/attachments/1467511838848847997/1475468285955932232/szatum.exe?ex=699ee9ec&is=699d986c&hm=4d10ad22da0b18019744b491de4be40b31b336c4b42d4067e16e967bfc07e8f8& Distribution URL hxxps://cdn.discordapp.com/attachments/6 |
| url | https://cdn.discordapp.com/attachments/684808088372510766/1458557911142895737/Fortnite_tweaks.exe?ex=69601368&is=695ec1e8&hm=4c997f6b315b450a4db6f7079966ff58203b7ef66023a36e97b4b1131d515ce7& | 1de4be40b31b336c4b42d4067e16e967bfc07e8f8& Distribution URL hxxps://cdn.discordapp.com/attachments/684808088372510766/1458557911142895737/Fortnite_tweaks.exe?ex=69601368&is=695ec1e8&hm=4c997f6b315b450a4db6f7079966ff58203b7ef66023a36e97b4b1131d515ce7& Note: IP addresses and domains are intentionally |
| url | https://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe | ds/ad/adac14669df84170ae21e99e542ff7d3.exe Distribution URL hxxps://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe Distribution URL hxxp://solaraexecutor.online/solara.zip Di |
| url | https://files.catbox.moe/11b8bu.py | hxxps://www.swiftexecutor.online/swift.zip Distribution URL hxxps://files.catbox.moe/11b8bu.py Distribution URL hxxps://github.com/shreddfv/Matcha-Externa |
| url | https://github.com/shreddfv/Matcha-External/archive/refs/heads/main.zip | ion URL hxxps://files.catbox.moe/11b8bu.py Distribution URL hxxps://github.com/shreddfv/Matcha-External/archive/refs/heads/main.zip Distribution URL hxxps://github.com/shreddfv/Matcha-Externa |
| url | https://github.com/shreddfv/Matcha-External/raw/refs/heads/main/Matcha.exe | atcha-External/archive/refs/heads/main.zip Distribution URL hxxps://github.com/shreddfv/Matcha-External/raw/refs/heads/main/Matcha.exe Distribution URL hxxps://github.com/shreddfv/Matrix-Hub-Ext |
| url | https://github.com/shreddfv/Matrix-Hub-External-Cracked/blob/main/newuimatrix.exe?raw=true | ha-External/raw/refs/heads/main/Matcha.exe Distribution URL hxxps://github.com/shreddfv/Matrix-Hub-External-Cracked/blob/main/newuimatrix.exe?raw=true Distribution URL hxxps://github.com/shreddfv/Matrix-Hub-Ext |
| url | https://github.com/shreddfv/Matrix-Hub-External-Cracked/raw/refs/heads/main/newuimatrix.exe | Cracked/blob/main/newuimatrix.exe?raw=true Distribution URL hxxps://github.com/shreddfv/Matrix-Hub-External-Cracked/raw/refs/heads/main/newuimatrix.exe Distribution URL hxxp://github.com/FomaNory/Roblox-Script-E |
| url | http://solaraexecutor.online/solara.zip | ds/ad/adac14669df84170ae21e99e542ff7d3.exe Distribution URL hxxp://solaraexecutor.online/solara.zip Distribution URL hxxps://www.swiftexecutor.online/swift.zip |
| url | https://www.swiftexecutor.online/swift.zip | RL hxxp://solaraexecutor.online/solara.zip Distribution URL hxxps://www.swiftexecutor.online/swift.zip Distribution URL hxxps://files.catbox.moe/11b8bu.py Distrib |
From the original article
4 min read at cybersecuritynews.com
Hackers are hiding a free information stealer called Marsalek inside fake cheats and tools for games such as Roblox, Fortnite, and Counter-Strike 2. The files look like helpful game add-ons. In the background they steal saved passwords, browser cookies, Discord tokens, and crypto wallet data from Windows PCs.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.