Maranhão Stealer: A New Malware Hijacks Gamers’ PCs Through Pirated Games

The Cyble Research and Intelligence Labs (CRIL) has uncovered an active campaign distributing a new information-stealing malware named Maranhão Stealer, first detected in May 2025. It targets gamers through social engineering websites that offer pirated software, cracked game launchers and cheats, using cloud-hosted platforms to deliver its payload.

According to CRIL, the threat actors primarily lure gaming users with trojanised installers for cracked or modified games, and notable malicious filenames include Fnafdoomlauncher.exe, Silent Client.exe and RootedTheGameSetup[.]zip. Once executed, Maranhão Stealer hides in a directory named Microsoft Updater under %localappdata%\\Programs and establishes persistence via Run registry keys and scheduled tasks, while marking its files as System and Hidden.

The malware harvests stored credentials and cookies, browsing history, session tokens and cryptocurrency wallet information, and uses reflective DLL injection to bypass protections in browsers, with data exfiltrated to attacker-controlled infrastructure via endpoints such as api.maranhaogang[.]fun/infect, /victim and /upload.

CRIL notes that newer builds embed password-decrypting functionality and drop components under C:\\Users\\MalWorkstation\\AppData\\Local\\Programs\\Microsoft Updater, illustrating a shift to more obfuscated, Go-written infoprocess.exe.