Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data

Hackers are hiding a free information stealer called Marsalek inside fake cheats and tools for games such as Roblox, Fortnite, and Counter-Strike 2.

The files look like helpful game add-ons. In the background they steal saved passwords, browser cookies, Discord tokens, and crypto wallet data from Windows PCs.

Marsalek ran from about December 2025 to May 2026 as malware-as-a-service, so anyone could sign up on a public site, build a malicious file, and watch victims on a dashboard.

The free tier did not even ask for a Discord or email account. Similar fake game cheat campaigns have pushed other stealers through GitHub and Reddit, which shows how popular this trick has become.

Analysts at McAfee Labs identified the malware and counted more than 1,560 registered accounts, over 400 malicious files, and more than 29 distribution URLs.

They also linked Marsalek to WeedHack, a Minecraft-focused service, because both point customers to the same Telegram support channel, @MetaMaskenMann.

Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats

Most of the lures copy tools that gamers already search for. McAfee saw fake versions of Roblox script executors such as Swift, Solara, MatrixHub External, and Matcha External.

Fake Minecraft clients such as Shadow Client and Boss Client also appeared, and a sample named Fortnite_tweaks.exe is in the indicator list.

The files spread through look-alike websites, Discord, and GitHub. Customers can start an infection with a PowerShell script, a ClickFix page, a Python file, or an EXE file. Bitdefender reported a related case with fake Roblox Xeno cheats that also targeted younger players.

After the first step, the chain is almost the same every time. The starter script downloads a portable Python package and a second file called python_setup.py.

That file tries to gain admin rights with a Windows tool called CMSTP, then hides the permission prompt and presses Enter for the user. It then adds 8 paths and 15 processes to Microsoft Defender’s exclusion list, so later files are not scanned.

The ClickFix page is a fake Cloudflare check, a trick also seen in the Warden Stealer malware campaign that tells victims to paste commands into Windows.

The third file, svc.py, does the main stealing in over 1,400 lines of code. It goes after 32 Chromium-based browsers and Firefox.

It also gets around Chrome’s App-Bound Encryption by injecting a DLL into a suspended Chrome, Edge, or Brave process, so the browser itself unlocks the key.

The malware checks 26 Discord paths, copies Telegram session data, and reads Mullvad VPN account details. It scans for 56 browser extensions and 12 wallet apps, and it looks for files with words like “seed,” “passphrase,” and “wallet.” In Exodus and Atomic Wallet it swaps in two .asar files to leave a backdoor.

Dual-Hook Design Turns Customers Into Victims

The last stage is PureLog, a low-cost stealer sold for as little as $59 a month. It is hidden with .NET Reactor, decrypted with Triple DES, and run only in memory.

It targets 35 browsers, 48 extensions, and 12 desktop apps, takes a screenshot, and sets a scheduled task that runs RunetimeBroker.exe every five minutes. It sends data to a separate server, telemetrydata.to.

This setup is called a dual hook. The customers think they own the stolen logs, but Marsalek’s author also gets a copy and may use a high-value victim’s accounts first.

The built-in FAQ even teaches buyers how to use stolen cookies and tokens and how to launder coins through Monero. McAfee saw the most activity in the United States, followed by Germany, the United Kingdom, India, and Brazil.

Gaming profiles are worth money, and it is easy to see attackers steal gaming accounts and then sell the items or reuse the same logins elsewhere.

The best defense is simple. Download games and tools only from official sources, never turn off antivirus because a site says it is a false alarm, and never paste commands from a web page.

Anyone who ran a suspicious cheat should change passwords from a clean device, sign out of all sessions, move crypto to a new wallet, and reinstall Windows. Readers can find the full technical details in the McAfee Labs Marsalek report.

Indicators of compromise (IoCs):-

SHA256 hashes

Stage	File name	SHA256
Stage 1	Fake CAPTCHA Page	c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97
Stage 1	build_1280.exe	98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4
Stage 1	build_1505.exe	29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb488c8add3f04ee087011
Stage 1	payload_1.ps1	ae975e468c26c67a2618d0da28d671c1101d01979a10677abe658a7b40f221be
Stage 1	ShadowClient.exe	04b0dbddaa7791445adbaf7c47fe388d4ddad724b2a6b55463d2a81cacf3339d
Stage 1	Discord Free Nitro Gen.exe	075d2ad32039674a2c65d899ae6760adf2457fe6af93710d204cee69e318a858
Stage 1	build_1540.exe	0c6f22efc8212739358ee2ce3564ffd3d193a74c1197cfc90d6345e33655ddeb
Stage 1	Fortnite_tweaks.exe	206e7a9a9cb0767d356de26d2f3b6fca85552c2d89104f343fc2e20a64e1efa4
Stage 1	r.vbs	279b6b8621f61f63e1537f7225bef375fc497342a812904d8194b5a44df3efbe
Stage 1	CS2-TriggerBot-main/main.py	fe510937483b1b79e9da1f1a18bc7fce21637c0ce7a5799259ee3d29e8364f1e
Stage 2	python_setup.py	4067e5f3dea8180dc47ea8c737b0cd2b11d4dfd5ef65f9e5ff30049eb8762f3e
Stage 2	downloaded_payload.txt	b75cc775a8c1f91d38dab69a9b7278b9ef7c84cf14435d374a6d7c2660e16c02
Stage 2	virus.py	6fb6adb819a82bc9e7afdc83649af7e9e23daec19b45d19ed92f1877bc54acd9
Stage 2	payload.py	091736aba514598513a936446a7776b1fa4585883bee38afb74cfe840176a8bc
Stage 2	python_setup.py	76d90ab4ba2be337e1ae03f69d12bfa873357bd5a0f177274a95b66621139c59
Stage 2	AsyncRAT.py	b28bbedac88d0b52531cf344f25ef95fe364e0f3ff9e5105a119f379d83c6ebd
Stage 2	python_setup.py	9327a55cb9e76aab18c404ae4c4b95f2be50fce57c65ba7c0c16ff48193e84ae
Stage 3	svc.py	3281e77e96bbd073ec8287928eadb2e47ba5337909800268bc9af0ee985def42
Stage 3	svc.py	7387b1ff5c2d4cdff9abcdb078742f26373e479f883bdd472f1aff58969b4fb2
Stage 3	svc.py	c12ffe59220fff73cabe6fd3cbec73a1c78df6988b742ae1d3a6458a82d135a7
Stage 3	svc.py	714267c512e8cfec6a535cda85897d901dfca9761c678b82781177ff13ec5923
Stage 3	svc.py	54ec316f639c97ec8b0cf321a8df32b1e9e2a19da91784f5575ed0a625ead811
Stage 3	src.py	2c1c38eb0c427ff5f2aaa3029cc4526f797676ee3ba154c6a980c39f9357e2df
Stage 3	chromedriver.dll	c7691712d794d4ef582c591566bf5fda76a364b0bcdad315adbaaec8607ad0f3
Stage 4	WinSvcHost.exe	9cf8bab29514d62595e148eb588f0cbecefb947d572c06b4547cff7ea4231747
Stage 4	Pdihj.exe	e0866124208da639f6cde652d78a3d5e350ad99dbd008aa48dbd1475af4e93ff
Stage 4	Kvxefnlfro.exe	9e4ea8b578475f18e092da73e56c0054261a881180d93f0909135bd6bdb4845d

Domains and distribution URLs

Type	Indicator
Main C2 domain	marsalek.cy
Secondary C2 domain	telemetrydata.to
Secondary C2 domain	huehnchenfarm.ru
Distribution URL	hxxp://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe
Distribution URL	hxxps://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe
Distribution URL	hxxp://solaraexecutor.online/solara.zip
Distribution URL	hxxps://www.swiftexecutor.online/swift.zip
Distribution URL	hxxps://files.catbox.moe/11b8bu.py
Distribution URL	hxxps://github.com/shreddfv/Matcha-External/archive/refs/heads/main.zip
Distribution URL	hxxps://github.com/shreddfv/Matcha-External/raw/refs/heads/main/Matcha.exe
Distribution URL	hxxps://github.com/shreddfv/Matrix-Hub-External-Cracked/blob/main/newuimatrix.exe?raw=true
Distribution URL	hxxps://github.com/shreddfv/Matrix-Hub-External-Cracked/raw/refs/heads/main/newuimatrix.exe
Distribution URL	hxxp://github.com/FomaNory/Roblox-Script-Executor/releases/download/Release/Executor.rar
Distribution URL	hxxp://130.12.180.43/files/6749237131/MVvd2DP.exe
Distribution URL	hxxp://130.12.180.43/files/5532726588/cPr84lu.exe
Distribution URL	hxxps://cdn.discordapp.com/attachments/1406651955421384817/1453822535136186560/net-nuker.exe?ex=69517c3f&is=69502abf&hm=4786f77b0db68586992f5e2f7f8961146ae3401cb3ae4edef52a69dce1392538&
Distribution URL	hxxps://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=695a5e73&is=69590cf3&hm=80369b451d7f9b20ebe4893adab9f7530dead3493e895aad7727b0b29ff1e50c&
Distribution URL	hxxps://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=699af7f3&is=6999a673&hm=6d372f7c5fc686135fedbc1943d7b1eff339fbfd91d26a62f3dddca1c1b7a884&
Distribution URL	hxxps://cdn.discordapp.com/attachments/1460394029215781075/1462929986381152378/netgen.exe?ex=696ffb38&is=696ea9b8&hm=50afe3eaad628cce1300d9571049357f09ae70fae17a56231736c335eda276de&
Distribution URL	hxxps://cdn.discordapp.com/attachments/1467511838848847997/1475468285955932232/szatum.exe?ex=699ee9ec&is=699d986c&hm=4d10ad22da0b18019744b491de4be40b31b336c4b42d4067e16e967bfc07e8f8&
Distribution URL	hxxps://cdn.discordapp.com/attachments/684808088372510766/1458557911142895737/Fortnite_tweaks.exe?ex=69601368&is=695ec1e8&hm=4c997f6b315b450a4db6f7079966ff58203b7ef66023a36e97b4b1131d515ce7&

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.