Marsalek Infostealer Spread via Fake Game Cheats Stealing Passwords and Crypto Wallets
First merged summary.
Marsalek infostealer was distributed as cheats for Roblox Fortnite and other games from December 2025 to May 2026 affecting over 1,560 accounts.
Marsalek malware-as-a-service disguised infostealers as game cheats and utilities for Roblox Fortnite Counter-Strike 2 Minecraft and Grim Dawn. It targeted over 1,560 accounts with more than 400 malicious files and 29 distribution URLs between mid-December 2025 and late May 2026. The stealer extracts passwords cookies Discord tokens and crypto wallets from multiple browsers and replaces wallet files with malicious archives. It used Python intermediate stages and .NET Reactor obfuscation for the final payload.
- Over 1,560 registered accounts affected
- Active from mid-December 2025 to late May 2026
- Targets 12 desktop crypto wallets and 26 Discord token paths
- Steals from 32+ browsers Firefox 56 extensions and 24 keywords
- Most infections in the United States followed by Germany UK
- Uses CMSTP UAC bypass scheduled tasks and Startup folder persistence
What each outlet adds
beyond the shared facts- GBHackersAdds stage three svc.py stealer details scanning 24 keywords and wallet .asar replacement.
- Cyber Security NewsAdds initial access methods including PowerShell ClickFix and CMSTP plus official sources defense.
- Vendors
- McAfeeBitdefender
Coverage
oldest first · one row per article · UTC- · 6d ago
GBHackersFirst report
Marsalek Infostealer spreads fake game cheats to steal browser data
MaaS platform Marsalek distributed cheats for Roblox and Fortnite, stealing passwords cookies Discord tokens and crypto wallets from over 1,560 accounts using CMSTP UAC bypass.
- · 6d ago
Cyber Security News
Marsalek stealer hidden in fake Roblox Fortnite cheats
The malware-as-a-service stealer targets passwords, Discord tokens, and crypto wallets through fake game cheats and tools.