Marsalek Infostealer spreads fake game cheats to steal browser data
Original title: Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies
MaaS platform Marsalek distributed cheats for Roblox and Fortnite, stealing passwords cookies Discord tokens and crypto wallets from over 1,560 accounts using CMSTP UAC bypass.
Marsalek disguised infostealers as game cheats and utilities for Roblox Fortnite Counter-Strike 2 Minecraft and Grim Dawn. Active from mid-December 2025 to late May 2026 researchers counted more than 1,560 registered accounts over 400 malicious files and 29 distribution URLs. The dashboard let users build payloads track victims and read stolen data. Intermediate stages use Python instead of Java. Stage three svc.py is a 1,400-line stealer that targets 32 Chromium browsers Firefox 56 browser extensions 12 desktop crypto wallets Discord tokens Telegram sessions and Mullvad VPN details. It scans for 24 keywords such as wallet and passphrase. The malware uses Startup folder persistence scheduled tasks and replaces files in Exodus and Atomic Wallet with malicious .asar archives. Final stage PureLog Stealer obfuscated with .NET Reactor sends data to separate command-and-control.
- More than 1,560 registered accounts
- Targets 12 desktop crypto wallets and 26 Discord token paths
- Reuses WeedHack final-stage payloads with Python intermediate stages
- Most infections in the United States followed by Germany UK India Brazil
Impact: browser passwords cookies Discord tokens and crypto wallets
- 1.Avoid fake game downloads and cracked software
- 2.Rotate passwords revoke Discord tokens and move crypto wallets
- 3.Watch for cmstp.exe with /au flag and bulk Defender exclusions
- Vendors
- McAfee
- Malware
- MarsalekPureLog Stealer
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | marsalek.cy | dle, @MetaMaskenMann. McAfee’s WeedHack IOC list also names marsalek[.]cy among other domains tied to the same operator. Marsalek r |
| sha256 | 29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb488c8add3f04ee087011 | 03356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4 build_1280.exe 29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb488c8add3f04ee087011 build_1505.exe ae975e468c26c67a2618d0da28d671c1101d01979a10 |
| sha256 | 98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4 | 732ae068c0cd6e3356343ca5ea3a916acdf6f3b97 Fake CAPTCHA Page 98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4 build_1280.exe 29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb |
| sha256 | ae975e468c26c67a2618d0da28d671c1101d01979a10677abe658a7b40f221be | 242dcb9d8a4a453b778f7dfb488c8add3f04ee087011 build_1505.exe ae975e468c26c67a2618d0da28d671c1101d01979a10677abe658a7b40f221be payload_1.ps1 Note: IP addresses and domains are intentiona |
| sha256 | c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97 | to new wallets. IOCs SHA256/URLs File Name Stage 1 Payload c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97 Fake CAPTCHA Page 98f138624ea96313dd5803356dc9428d230e535b5 |
From the original article
3 min read at gbhackers.com
Marsalek, a free malware-as-a-service (MaaS) platform that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. It was active from mid-December 2025 to late May 2026. Researchers counted more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.