Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies

Marsalek, a free malware-as-a-service (MaaS) platform that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn.

It was active from mid-December 2025 to late May 2026. Researchers counted more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs.

Its dashboard let users build payloads, track victims and read stolen data, with no Discord or email account required for the free tier.

Marsalek ran in parallel with WeedHack, the Minecraft-focused MaaS campaign McAfee documented in June 2026.

Both point customers to the same Telegram support handle, @MetaMaskenMann. McAfee’s WeedHack IOC list also names marsalek[.]cy among other domains tied to the same operator.

Marsalek reuses WeedHack’s final-stage payloads, but its intermediate stages use Python instead of Java.

Customers choose from four stage-one vectors: PowerShell, ClickFix fake CAPTCHA pages, Python scripts and PE executables.

These pose as Roblox executors such as Solara and Swift, or Minecraft clients such as Shadow Client. Each vector downloads a portable Python runtime and installs packages including cryptography and requests.

The malware then runs python_setup.py, which escalates privileges through a CMSTP UAC bypass. This is the same technique used in WeedHack.

The script then writes WinDefConfig.cmd, which adds 8 exclusion paths and 15 exclusion processes to Microsoft Defender. Stage three, svc.py, is a roughly 1,400-line stealer.

It targets 32 Chromium browsers, as well as Firefox, 56 browser extensions and 12 desktop crypto wallets. It also takes Discord tokens from 26 paths, plus Telegram session data and Mullvad VPN account details.

It scans user folders for files matching 24 keywords, such as “seed”, “wallet” and “passphrase”. For persistence it uses the Startup folder and scheduled tasks.

Marsalek Infostealer

In August 2026, McAfee reported that, WeedHack sites were still active and spreading malware through SEO poisoning.

The most notable technique targets Chrome’s App-Bound Encryption on Chrome, Edge and Brave. The malware launches the browser suspended and injects a DLL into it.

The DLL asks the browser’s Elevation Service to decrypt the master key. The service sees a request from a legitimate browser process and complies.

Marsalek then decrypts v20-prefixed cookies, passwords and tokens with AES-GCM. It also replaces files in Exodus and Atomic Wallet with malicious .asar archives, creating backdoors in both.

The final stage is PureLog Stealer, obfuscated with .NET Reactor and loaded in memory after 3DES and GZIP decryption. PureLog sends stolen data to a separate command-and-control server.

The campaign owner therefore receives everything Marsalek’s own customers collect, and may exploit high-value victims first.

A premium tier was only marked “coming soon”, so the operator could abandon the infrastructure at any time. PureLogs has sold since 2022 for as little as $59 a month.

The dashboard’s FAQ taught customers how to use stolen cookies and Discord tokens. It also told them how to launder crypto through Monero using services such as ETZ-swap and Trocador.

McAfee saw the most infections in the United States, followed by Germany, the United Kingdom, India and Brazil. Many customers appear to be teenagers, which echoes the cyberbullying McAfee saw in the WeedHack Telegram channel.

The tactic is not new. In January 2025, McAfee found GitHub repositories offering game hacks and cracked software that delivered Lumma Stealer. They told victims to turn off antivirus first.

Avoid executables shared on Discord and cracked or cheat software from unofficial sites. Treat any instruction to disable antivirus as a red flag.

Defenders should watch for cmstp.exe launched with the /au flag, bulk Defender exclusion changes, and unexpected Python runtimes in user directories.

Users who ran such files should rotate passwords, revoke sessions and Discord tokens, and move crypto to new wallets.

IOCs

SHA256/URLs	File Name
Stage 1 Payload
c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97	Fake CAPTCHA Page
98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4	build_1280.exe
29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb488c8add3f04ee087011	build_1505.exe
ae975e468c26c67a2618d0da28d671c1101d01979a10677abe658a7b40f221be	payload_1.ps1

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.