Marsalek malware service steals game users’ passwords and wallets

McAfee Labs says a free malware-as-a-service operation distributed Marsalek infostealers disguised as cheats, game clients and utilities for Roblox, Fortnite, Minecraft, Counter-Strike 2 and Grim Dawn. Active from mid-December 2025 to late May 2026, its dashboard let users build malicious scripts and Windows executables, as well as fake Cloudflare ClickFix pages. These were shared through Discord, GitHub and imitation websites.

The operation recorded more than 1,560 registered accounts, over 400 malicious files and 29 or more distribution domains; infections were concentrated in the United States, followed by Germany, the UK, India, Brazil, Poland, the Netherlands, Italy and Canada.

McAfee Labs found a technical link to the WeedHack operation through shared final-stage payloads and the Telegram support account @MetaMaskenMann. The malware can use Windows’ cmstp.exe utility with the /au switch to bypass User Account Control, add paths and processes to Microsoft Defender’s exclusion list, and inject a DLL into browsers to evade Chrome App-Bound Encryption protections. It steals browser credentials and cookies, cryptocurrency data and files, and can install backdoors in Exodus and Atomic Wallet.

After sending stolen data to an affiliate’s server, Marsalek deploys a separate PureLog .NET stealer, which sends another copy to a different server controlled by the platform operator. McAfee says this gives the operator access to credentials gathered from victims targeted by affiliates.

Although the dashboard went offline in May 2026, McAfee warns that previously distributed installers and scheduled tasks may remain active. Its detection guidance includes monitoring for cmstp.exe using /au, mass Defender exclusions and suspicious RunetimeBroker.exe scheduled tasks. It advises suspected victims to reinstall affected wallets from official sources, revoke sessions and change passwords and wallet seed phrases from a clean computer.